6eda82bafd06ea58a78653f22d17c094cb8e1fe62a3dfd28dc845e99e34a01fa

Analysis

user interaction
yes
max time kernel
0s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file01.vbs
Size 693B
Sample260717-w1e44set31
SHA256 6eda82bafd06ea58a78653f22d17c094cb8e1fe62a3dfd28dc845e99e34a01fa
MD5 26be4ef1cfa8a8f9e098c4307806347f
SHA1 91ed735611a0a465225924cf4295ec70771d7bde
SHA512 12a17ece9e95641802bf0330cda6435e86bfd1ac72899cf87adf4a92cf00c330368e5870a854f3c74648409f9c33dbabaaab23c06936ed5133e00e5fec1cfc66
TLSH
T1CD017D83BD4699625532DEB705A3A844D004C11B809AAE563ECC9180BF3775C98C54AC
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution exploit

Malware Config

Signatures

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
11744	Process not Found
6512	takeown.exe
7500	takeown.exe
8188	Process not Found
6420	Process not Found
13276	Process not Found
2480	Process not Found
1616	icacls.exe
7488	icacls.exe
9024	Process not Found
8924	Process not Found
11468	Process not Found
6276	icacls.exe
6480	Process not Found
12448	Process not Found
1808	takeown.exe
6952	icacls.exe
9736	Process not Found
8632	Process not Found
10148	Process not Found
6584	Process not Found
5464	takeown.exe
8316	icacls.exe
3836	icacls.exe
4332	icacls.exe
6280	takeown.exe
8264	Process not Found
11292	Process not Found
7728	Process not Found
7904	Process not Found
1052	takeown.exe
8652	takeown.exe
2192	takeown.exe
8636	Process not Found
10100	Process not Found
7380	Process not Found
5804	icacls.exe
7220	icacls.exe
6052	takeown.exe
10160	Process not Found
8944	Process not Found
7368	Process not Found
11540	Process not Found
12588	Process not Found
2808	takeown.exe
4456	takeown.exe
7800	takeown.exe
6432	Process not Found
5904	Process not Found
4560	Process not Found
9140	Process not Found
9172	Process not Found
5832	icacls.exe
408	icacls.exe
4520	takeown.exe
9172	takeown.exe
9044	Process not Found
10880	Process not Found
5316	Process not Found
8216	Process not Found
3556	takeown.exe
568	takeown.exe
7456	takeown.exe
8988	takeown.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	WScript.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
10104	icacls.exe
9584	Process not Found
9260	Process not Found
6304	Process not Found
3300	icacls.exe
540	takeown.exe
5416	icacls.exe
12976	Process not Found
4132	Process not Found
5380	takeown.exe
8724	icacls.exe
5476	icacls.exe
11000	Process not Found
7360	Process not Found
12112	Process not Found
5712	Process not Found
9272	Process not Found
6680	Process not Found
3464	Process not Found
5760	icacls.exe
12948	Process not Found
12612	Process not Found
3576	takeown.exe
9072	Process not Found
8532	Process not Found
8088	Process not Found
1764	Process not Found
9624	Process not Found
11700	Process not Found
1212	Process not Found
7912	icacls.exe
12996	Process not Found
10600	Process not Found
12560	Process not Found
11680	Process not Found
6136	icacls.exe
5432	Process not Found
9140	Process not Found
12224	Process not Found
6376	Process not Found
1204	Process not Found
2176	Process not Found
9972	Process not Found
8848	Process not Found
11892	Process not Found
10256	Process not Found
9904	Process not Found
11636	Process not Found
4256	icacls.exe
6780	takeown.exe
7552	takeown.exe
1400	takeown.exe
10884	Process not Found
3220	Process not Found
3736	Process not Found
5040	Process not Found
10144	Process not Found
10164	Process not Found
12292	Process not Found
12620	Process not Found
12720	Process not Found
1440	Process not Found
10644	Process not Found
8748	icacls.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
2916	WScript.exe
5456	WScript.exe
4224	WScript.exe
6880	WScript.exe
3536	WScript.exe
3592	WScript.exe
5256	WScript.exe
8284	WScript.exe
9000	WScript.exe
2100	Process not Found
888	WScript.exe
6400	WScript.exe
8008	Process not Found
11416	Process not Found
11656	Process not Found
2072	WScript.exe
6388	WScript.exe
6472	WScript.exe
9560	WScript.exe
2068	WScript.exe
7272	WScript.exe
9020	WScript.exe
9100	Process not Found
11072	Process not Found
9836	Process not Found
12676	Process not Found
4112	Process not Found
1588	WScript.exe
1608	WScript.exe
4984	WScript.exe
5900	WScript.exe
5896	WScript.exe
5764	WScript.exe
6956	WScript.exe
11240	Process not Found
8308	WScript.exe
5956	WScript.exe
8300	WScript.exe
13300	Process not Found
5532	Process not Found
12764	Process not Found
6904	WScript.exe
1964	WScript.exe
3192	WScript.exe
1788	Process not Found
6008	Process not Found
6068	WScript.exe
5136	Process not Found
13204	Process not Found
6692	WScript.exe
3316	WScript.exe
6316	Process not Found
1404	WScript.exe
4420	WScript.exe
5304	WScript.exe
9964	Process not Found
6340	Process not Found
844	WScript.exe
6476	WScript.exe
8340	WScript.exe
6092	WScript.exe
1180	WScript.exe
8092	WScript.exe
5132	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4880	Process not Found

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	WScript.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1796	1404	WScript.exe	85
PID 1404 wrote to memory of 4552	1404	WScript.exe	1071
PID 1796 wrote to memory of 2068	1796	WScript.exe	88

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2068
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4420
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        5⤵
        
        PID:4508
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        7⤵
        
        PID:3216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        8⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        9⤵
        
        PID:3852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        10⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        11⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2072
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        12⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        13⤵
        
        PID:1864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        14⤵
        
        PID:736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        15⤵
        
        PID:3524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        16⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        17⤵
        
        PID:4588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        18⤵
        
        PID:2288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        19⤵
        
        PID:3576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        20⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        21⤵
        
        PID:4952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        22⤵
        
        PID:2568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        23⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        24⤵
        
        PID:4700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        25⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5256
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        26⤵
        
        PID:5780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        27⤵
        
        PID:1736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        28⤵
        
        PID:2616
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        29⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        30⤵
        
        PID:3584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        31⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        32⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        33⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        34⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1180
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        35⤵
        
        PID:2440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        36⤵
        
        PID:6520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        37⤵
        
        PID:1748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        38⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        39⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        40⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        41⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        42⤵
        
        PID:6560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        43⤵
        
        PID:6408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        44⤵
        
        PID:7056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        45⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        46⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        47⤵
        
        PID:6176
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        48⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        49⤵
        
        PID:7556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        50⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        51⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        52⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6476
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        53⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        54⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        55⤵
        
        PID:5200
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        56⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        57⤵
        
        PID:7908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        58⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        59⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        60⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        61⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        62⤵
        
        PID:2412
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        63⤵
        
        PID:8032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        64⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:9020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        65⤵
        
        PID:7408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        66⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        67⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        68⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        69⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        70⤵
        
        PID:8988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        71⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        72⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:9000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        73⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        74⤵
        
        PID:8372
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        75⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:9560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        76⤵
        
        PID:5944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        77⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8300
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        77⤵
        
        PID:9976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        76⤵
        
        PID:8804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        75⤵
        
        PID:9644
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        74⤵
        
        PID:6272
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        74⤵
        
        PID:10184
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        73⤵
        
        PID:8080
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        73⤵
        
        PID:7644
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        72⤵
        Possible privilege escalation attempt
        
        PID:7800
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        72⤵
        
        PID:5424
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        71⤵
        
        PID:4792
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        71⤵
        
        PID:9524
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        71⤵
        
        PID:5380
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        70⤵
        
        PID:5040
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        70⤵
        
        PID:5472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        70⤵
        
        PID:7776
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        69⤵
        
        PID:6060
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        69⤵
        
        PID:7292
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        69⤵
        
        PID:4520
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        68⤵
        
        PID:7952
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        68⤵
        
        PID:8136
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        68⤵
        
        PID:9708
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        68⤵
        
        PID:6552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        67⤵
        
        PID:7356
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        67⤵
        
        PID:8404
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        67⤵
        
        PID:4544
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        66⤵
        
        PID:8804
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        66⤵
        
        PID:7340
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        66⤵
        
        PID:8432
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        66⤵
        
        PID:8620
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        65⤵
        
        PID:8852
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        65⤵
        
        PID:8364
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        65⤵
        
        PID:7936
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        65⤵
        
        PID:9616
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        64⤵
        
        PID:7472
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        64⤵
        
        PID:6076
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        64⤵
        
        PID:6364
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        64⤵
        
        PID:7388
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        63⤵
        Modifies file permissions
        
        PID:7552
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        63⤵
        
        PID:772
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        63⤵
        
        PID:7236
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        63⤵
        
        PID:9516
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        63⤵
        
        PID:8524
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        62⤵
        
        PID:6236
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        62⤵
        
        PID:7572
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        62⤵
        
        PID:7544
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        62⤵
        
        PID:2228
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        62⤵
        
        PID:9900
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        61⤵
        
        PID:7724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        61⤵
        
        PID:6820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        61⤵
        
        PID:7308
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        61⤵
        
        PID:8916
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        61⤵
        
        PID:8200
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        60⤵
        
        PID:8424
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        60⤵
        
        PID:5476
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        60⤵
        
        PID:7724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        60⤵
        
        PID:384
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        60⤵
        
        PID:6552
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        60⤵
        
        PID:9656
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        60⤵
        
        PID:5340
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        59⤵
        
        PID:7260
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        59⤵
        
        PID:8140
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        59⤵
        
        PID:7780
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        59⤵
        
        PID:4520
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        59⤵
        
        PID:5392
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        59⤵
        
        PID:10064
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        59⤵
        
        PID:5220
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        58⤵
        
        PID:7820
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        58⤵
        
        PID:7848
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        58⤵
        
        PID:5540
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        58⤵
        
        PID:6304
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        58⤵
        
        PID:7660
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        58⤵
        
        PID:9004
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        58⤵
        
        PID:8660
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        57⤵
        
        PID:6236
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        57⤵
        
        PID:7520
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        57⤵
        
        PID:8556
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        57⤵
        
        PID:7044
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        57⤵
        
        PID:9008
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        57⤵
        
        PID:6100
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        56⤵
        
        PID:7968
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        56⤵
        
        PID:6432
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        56⤵
        
        PID:7608
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        56⤵
        
        PID:7192
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        56⤵
        Possible privilege escalation attempt
        
        PID:2192
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        56⤵
        
        PID:6344
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        55⤵
        
        PID:7616
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        55⤵
        
        PID:6472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        55⤵
        
        PID:7592
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        55⤵
        
        PID:5340
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        55⤵
        
        PID:9160
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        55⤵
        
        PID:7584
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        55⤵
        
        PID:6876
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        55⤵
        
        PID:6160
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        54⤵
        
        PID:8144
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        54⤵
        
        PID:7136
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        54⤵
        Possible privilege escalation attempt
        
        PID:7456
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        54⤵
        
        PID:4020
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        54⤵
        
        PID:3864
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        54⤵
        
        PID:8756
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        54⤵
        
        PID:8548
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        53⤵
        
        PID:2860
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        53⤵
        
        PID:7352
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        53⤵
        
        PID:9048
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        53⤵
        
        PID:8740
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        53⤵
        
        PID:6588
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        53⤵
        
        PID:2480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        53⤵
        
        PID:4232
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        52⤵
        
        PID:6864
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        52⤵
        
        PID:5272
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        52⤵
        
        PID:8800
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        52⤵
        
        PID:7716
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        52⤵
        
        PID:2524
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        52⤵
        Possible privilege escalation attempt
        
        PID:8316
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        52⤵
        
        PID:5804
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        52⤵
        
        PID:7864
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        51⤵
        
        PID:7384
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        51⤵
        
        PID:7160
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        51⤵
        
        PID:4644
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        51⤵
        
        PID:8176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        51⤵
        
        PID:8764
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        51⤵
        
        PID:7092
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        51⤵
        
        PID:1156
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        51⤵
        
        PID:8136
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        50⤵
        
        PID:6952
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        50⤵
        
        PID:6708
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        50⤵
        
        PID:5320
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        50⤵
        
        PID:8784
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        50⤵
        
        PID:5592
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        50⤵
        
        PID:4688
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        50⤵
        
        PID:7084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        50⤵
        
        PID:5672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        50⤵
        
        PID:6220
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        49⤵
        
        PID:7736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        49⤵
        
        PID:7204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        49⤵
        
        PID:6040
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        49⤵
        
        PID:2860
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        49⤵
        Modifies file permissions
        
        PID:5380
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        49⤵
        
        PID:7256
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        49⤵
        
        PID:5412
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        49⤵
        
        PID:6604
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        48⤵
        
        PID:772
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        48⤵
        
        PID:5648
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        48⤵
        
        PID:6848
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        48⤵
        
        PID:6496
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        48⤵
        
        PID:7428
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        48⤵
        
        PID:6268
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        48⤵
        
        PID:5960
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        48⤵
        
        PID:7804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        48⤵
        
        PID:7872
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        47⤵
        
        PID:408
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        47⤵
        
        PID:7376
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        47⤵
        
        PID:6680
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        47⤵
        
        PID:5672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        47⤵
        
        PID:8792
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        47⤵
        
        PID:5512
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        47⤵
        
        PID:8104
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        47⤵
        
        PID:5424
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        47⤵
        
        PID:8520
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        47⤵
        
        PID:9364
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        46⤵
        
        PID:7072
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        46⤵
        
        PID:7668
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        46⤵
        
        PID:6624
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        46⤵
        
        PID:7188
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        46⤵
        
        PID:8912
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        46⤵
        
        PID:8196
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        46⤵
        
        PID:6672
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        46⤵
        
        PID:9072
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        46⤵
        
        PID:1156
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        45⤵
        
        PID:6356
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        45⤵
        
        PID:6656
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        45⤵
        
        PID:1772
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        45⤵
        
        PID:4816
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        45⤵
        
        PID:468
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        45⤵
        
        PID:5960
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        45⤵
        Possible privilege escalation attempt
        
        PID:8652
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        45⤵
        
        PID:5540
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        45⤵
        
        PID:7200
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        45⤵
        
        PID:10052
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        44⤵
        
        PID:1108
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        44⤵
        Possible privilege escalation attempt
        
        PID:3836
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        44⤵
        
        PID:8184
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        44⤵
        
        PID:2348
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        44⤵
        
        PID:1156
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        44⤵
        
        PID:6336
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        44⤵
        
        PID:8532
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        44⤵
        Modifies file permissions
        
        PID:8724
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        44⤵
        
        PID:5432
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        44⤵
        Modifies file permissions
        
        PID:7912
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        44⤵
        
        PID:9108
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        43⤵
        
        PID:5640
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        43⤵
        
        PID:6772
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        43⤵
        
        PID:7188
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        43⤵
        
        PID:7696
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        43⤵
        
        PID:7724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        43⤵
        
        PID:9124
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        43⤵
        
        PID:8904
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        43⤵
        
        PID:4128
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        43⤵
        
        PID:7320
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        43⤵
        
        PID:10124
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        42⤵
        
        PID:5272
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        42⤵
        
        PID:6192
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        42⤵
        
        PID:7472
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        42⤵
        
        PID:7512
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        42⤵
        
        PID:6028
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        42⤵
        
        PID:5192
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        42⤵
        
        PID:7212
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        42⤵
        
        PID:8296
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        42⤵
        
        PID:8956
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        42⤵
        
        PID:5192
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        41⤵
        
        PID:888
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:6536
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        41⤵
        
        PID:1868
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:7068
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        41⤵
        
        PID:8128
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:4020
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        41⤵
        
        PID:8928
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:1788
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        41⤵
        
        PID:8880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:9112
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        41⤵
        
        PID:9188
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:8060
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        40⤵
        
        PID:6580
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:5612
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        40⤵
        
        PID:6096
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:4344
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        40⤵
        
        PID:1156
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:7456
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        40⤵
        
        PID:8540
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:1156
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        40⤵
        
        PID:4716
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:9140
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        40⤵
        
        PID:5488
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:2852
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        39⤵
        
        PID:5412
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:5980
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        39⤵
        
        PID:4224
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:3488
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        39⤵
        
        PID:6396
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:7172
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        39⤵
        
        PID:7216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:8388
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        39⤵
        
        PID:6392
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:8228
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        39⤵
        
        PID:2028
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:8632
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        38⤵
        
        PID:5280
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:4792
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        38⤵
        
        PID:740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:6428
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        38⤵
        
        PID:5336
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:7712
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        38⤵
        
        PID:4704
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:7936
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        38⤵
        
        PID:4532
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:5644
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        38⤵
        Possible privilege escalation attempt
        
        PID:6280
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:7300
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        37⤵
        
        PID:5420
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:6140
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        37⤵
        
        PID:6220
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:4644
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        37⤵
        
        PID:7988
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:7392
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        37⤵
        
        PID:7840
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:4324
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        37⤵
        
        PID:5800
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:7536
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        37⤵
        
        PID:8084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:7372
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        37⤵
        
        PID:7620
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        36⤵
        
        PID:6656
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        36⤵
        Modifies file permissions
        
        PID:5760
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        36⤵
        
        PID:6236
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:3384
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        36⤵
        
        PID:6644
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:6336
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        
        PID:4552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        36⤵
        
        PID:7012
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:2400
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        36⤵
        
        PID:8008
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:1156
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        36⤵
        
        PID:8216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:8876
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        35⤵
        
        PID:5564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:6348
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        35⤵
        
        PID:2412
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:1440
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        35⤵
        
        PID:7508
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:7192
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        35⤵
        
        PID:7500
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:6564
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        35⤵
        
        PID:8836
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:628
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        35⤵
        
        PID:7656
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:8812
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        35⤵
        
        PID:8176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        34⤵
        
        PID:5308
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:6356
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        34⤵
        
        PID:6916
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:6924
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        34⤵
        
        PID:7004
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:5828
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        34⤵
        
        PID:8084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:8056
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        34⤵
        Possible privilege escalation attempt
        
        PID:7500
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:9204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        34⤵
        
        PID:8356
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:4256
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        34⤵
        
        PID:6496
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:8420
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        33⤵
        
        PID:6012
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:6664
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        33⤵
        
        PID:5272
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:3172
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        33⤵
        
        PID:7096
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        33⤵
        Possible privilege escalation attempt
        
        PID:7488
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        33⤵
        
        PID:5552
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:7256
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        33⤵
        
        PID:7084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:4456
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        33⤵
        
        PID:8644
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:7004
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        33⤵
        
        PID:6744
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:7672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        32⤵
        
        PID:4764
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:7048
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        32⤵
        
        PID:7064
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:6788
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        32⤵
        
        PID:5544
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:7784
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        32⤵
        
        PID:2728
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:5444
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        32⤵
        
        PID:8348
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:7536
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        32⤵
        Possible privilege escalation attempt
        
        PID:8988
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:8496
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        32⤵
        
        PID:7192
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:6768
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        31⤵
        
        PID:5888
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:6220
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        31⤵
        
        PID:1684
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:1772
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        31⤵
        
        PID:3396
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:6056
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        31⤵
        
        PID:5968
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:5180
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        31⤵
        
        PID:7620
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:5392
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        31⤵
        
        PID:8916
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:6876
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        31⤵
        
        PID:5484
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:10168
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        30⤵
        
        PID:5764
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:1112
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        30⤵
        
        PID:6532
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:5372
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        30⤵
        
        PID:6556
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:5656
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        30⤵
        
        PID:1708
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:1788
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        30⤵
        
        PID:6460
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:5416
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        30⤵
        
        PID:8936
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:8488
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        30⤵
        
        PID:7124
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:5212
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        29⤵
        
        PID:4224
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        29⤵
        Possible privilege escalation attempt
        
        PID:5804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        29⤵
        
        PID:6456
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:4248
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        29⤵
        
        PID:4520
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:6184
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        29⤵
        
        PID:6052
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:5464
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        29⤵
        
        PID:6192
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:5804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        29⤵
        
        PID:6268
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:5828
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        29⤵
        
        PID:7172
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        29⤵
        Modifies file permissions
        
        PID:8748
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        29⤵
        
        PID:7424
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        28⤵
        
        PID:740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:5240
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        28⤵
        
        PID:1096
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:1772
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        28⤵
        
        PID:6684
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:6940
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        28⤵
        
        PID:5348
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:8144
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        28⤵
        
        PID:7588
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:1064
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        28⤵
        
        PID:6728
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:9132
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        28⤵
        
        PID:7804
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:7464
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        28⤵
        
        PID:7124
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        27⤵
        
        PID:5352
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:3728
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        27⤵
        
        PID:6128
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:7072
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        27⤵
        
        PID:6504
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6540
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        27⤵
        
        PID:6264
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:5468
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        27⤵
        
        PID:7112
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:7792
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        27⤵
        
        PID:9100
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:7508
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        27⤵
        
        PID:8832
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        27⤵
        
        PID:2088
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        26⤵
        
        PID:5952
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:5376
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        26⤵
        
        PID:4436
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6336
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        26⤵
        
        PID:7088
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        26⤵
        
        PID:5464
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:7996
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        26⤵
        Possible privilege escalation attempt
        
        PID:4520
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:5552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        26⤵
        
        PID:5956
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        26⤵
        
        PID:5228
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6452
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        26⤵
        
        PID:7120
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:7680
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        25⤵
        
        PID:5280
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:4792
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        25⤵
        
        PID:1992
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:5504
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        25⤵
        
        PID:3248
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:5236
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        25⤵
        
        PID:6612
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6304
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        25⤵
        
        PID:7464
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6136
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        25⤵
        
        PID:7372
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:7728
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        25⤵
        
        PID:7276
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:8404
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        25⤵
        
        PID:8392
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:588
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        25⤵
        
        PID:5852
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        24⤵
        
        PID:5124
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:5364
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        24⤵
        
        PID:5588
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:3248
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        24⤵
        
        PID:6448
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:6692
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        24⤵
        
        PID:7028
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:6104
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        24⤵
        
        PID:6540
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:7536
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        24⤵
        
        PID:6436
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:4464
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        24⤵
        
        PID:8136
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:7992
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        24⤵
        
        PID:9004
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:5040
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        24⤵
        
        PID:4020
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        23⤵
        
        PID:1748
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:6016
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        23⤵
        
        PID:6100
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:5172
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        23⤵
        
        PID:6500
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:6604
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        23⤵
        
        PID:5372
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:5340
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        23⤵
        
        PID:7564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:1056
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        23⤵
        
        PID:5332
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:6300
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        23⤵
        
        PID:6396
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        23⤵
        Possible privilege escalation attempt
        
        PID:6952
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        23⤵
        
        PID:9188
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:4312
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        23⤵
        
        PID:9964
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        22⤵
        
        PID:3316
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:1760
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        22⤵
        
        PID:6032
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:5968
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        22⤵
        
        PID:5508
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:7064
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        22⤵
        
        PID:5728
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:5132
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        22⤵
        
        PID:5672
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:5512
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        22⤵
        
        PID:6156
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        22⤵
        Possible privilege escalation attempt
        
        PID:7220
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        22⤵
        
        PID:7644
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:8596
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        22⤵
        Modifies file permissions
        
        PID:1400
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:7872
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        22⤵
        
        PID:9308
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        21⤵
        
        PID:1884
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        21⤵
        Modifies file permissions
        
        PID:4256
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        21⤵
        
        PID:5844
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:5692
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        21⤵
        
        PID:5280
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:6800
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        21⤵
        
        PID:5956
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:5324
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        21⤵
        
        PID:6956
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:7432
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        21⤵
        
        PID:976
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:7184
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        21⤵
        
        PID:6224
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:7868
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        21⤵
        
        PID:5332
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:4204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        21⤵
        
        PID:7716
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        21⤵
        Modifies file permissions
        
        PID:5416
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        20⤵
        
        PID:2348
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:1964
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        20⤵
        
        PID:5960
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:5988
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        20⤵
        
        PID:2176
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:7080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        20⤵
        
        PID:6296
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:5732
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        20⤵
        
        PID:5968
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:8120
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        20⤵
        
        PID:6188
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:6268
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        20⤵
        
        PID:8904
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:7120
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        20⤵
        
        PID:7752
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:3952
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        20⤵
        
        PID:9620
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:7104
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        19⤵
        
        PID:4368
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:1012
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        19⤵
        
        PID:5412
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        19⤵
        Possible privilege escalation attempt
        
        PID:408
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        19⤵
        
        PID:4648
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:5416
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        19⤵
        
        PID:6940
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:6440
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        19⤵
        Modifies file permissions
        
        PID:6780
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:6624
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        19⤵
        
        PID:5664
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:7092
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        19⤵
        
        PID:7252
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:7980
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        19⤵
        
        PID:7264
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:9060
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        19⤵
        
        PID:8592
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:9512
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        18⤵
        
        PID:3724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:2964
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        18⤵
        
        PID:3736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:2396
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        18⤵
        
        PID:6132
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        18⤵
        Possible privilege escalation attempt
        
        PID:5832
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        18⤵
        
        PID:7032
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:6640
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        18⤵
        
        PID:6672
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:6484
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        18⤵
        
        PID:7980
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:5264
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        18⤵
        
        PID:6288
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:6888
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        18⤵
        
        PID:8492
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:8336
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        18⤵
        
        PID:6556
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:9492
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        17⤵
        
        PID:2324
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:1060
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        17⤵
        
        PID:4368
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:5476
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        17⤵
        
        PID:3964
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:5956
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        17⤵
        
        PID:5808
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:6592
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        17⤵
        
        PID:3844
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:5812
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        17⤵
        
        PID:4580
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:452
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        17⤵
        
        PID:8044
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:7380
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        17⤵
        
        PID:6208
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:2836
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        17⤵
        
        PID:1216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:4248
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        17⤵
        
        PID:7572
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:1096
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        16⤵
        
        PID:4584
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:4952
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        16⤵
        Modifies file permissions
        
        PID:540
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:2348
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        16⤵
        
        PID:5880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:5732
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        16⤵
        
        PID:6056
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:7088
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        16⤵
        
        PID:2348
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:2948
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        16⤵
        
        PID:3248
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:8160
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        16⤵
        
        PID:4156
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:7472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        16⤵
        
        PID:8356
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6544
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        16⤵
        Possible privilege escalation attempt
        
        PID:9172
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:7472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        16⤵
        
        PID:4232
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:9132
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        15⤵
        Possible privilege escalation attempt
        
        PID:2808
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:2148
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        15⤵
        
        PID:1056
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:3808
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        15⤵
        
        PID:5044
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:5824
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        15⤵
        
        PID:1108
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:6116
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        15⤵
        
        PID:5540
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:5736
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        15⤵
        
        PID:6740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:5880
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        15⤵
        
        PID:6104
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:7044
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        15⤵
        
        PID:6820
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:6364
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        15⤵
        
        PID:5760
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:5472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        15⤵
        
        PID:5832
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:5820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
        15⤵
        
        PID:9260
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        14⤵
        
        PID:536
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:1124
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        14⤵
        
        PID:3460
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:2168
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        14⤵
        
        PID:452
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:6040
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        14⤵
        
        PID:1480
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:5608
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        14⤵
        
        PID:6380
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:5860
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        14⤵
        
        PID:5216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:5452
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        14⤵
        
        PID:5452
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:6772
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        14⤵
        
        PID:3736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:8816
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        14⤵
        
        PID:2480
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:7704
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        14⤵
        
        PID:8648
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:8464
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
        14⤵
        
        PID:9200
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        13⤵
        
        PID:1216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:2940
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        13⤵
        
        PID:1708
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:4324
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        13⤵
        
        PID:3776
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:5560
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        13⤵
        
        PID:2776
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:5912
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        13⤵
        
        PID:5852
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:3952
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        13⤵
        
        PID:5444
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:5240
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        13⤵
        
        PID:5180
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:7504
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        13⤵
        
        PID:6440
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:7460
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        13⤵
        
        PID:7940
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:6344
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        13⤵
        Possible privilege escalation attempt
        
        PID:4456
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:5880
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
        13⤵
        
        PID:9220
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        12⤵
        
        PID:1704
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:4532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        12⤵
        
        PID:2624
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:2760
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        12⤵
        
        PID:1624
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:1544
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        12⤵
        
        PID:6120
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:5484
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        12⤵
        
        PID:5568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:6916
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        12⤵
        
        PID:5852
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:6092
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        12⤵
        
        PID:5720
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:7268
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        12⤵
        
        PID:5752
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:7708
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        12⤵
        
        PID:8936
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        12⤵
        Possible privilege escalation attempt
        
        PID:4332
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        12⤵
        
        PID:6404
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:9088
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
        12⤵
        
        PID:7544
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetEnter.wpl" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:7804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        11⤵
        
        PID:4384
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:3760
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        11⤵
        
        PID:1808
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:3984
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        11⤵
        
        PID:3884
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:2396
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        11⤵
        
        PID:5640
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:5544
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        11⤵
        
        PID:5856
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:1444
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        11⤵
        
        PID:7056
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:6728
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        11⤵
        
        PID:1112
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:5940
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        11⤵
        
        PID:6252
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:5492
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        11⤵
        
        PID:5872
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:9116
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        11⤵
        
        PID:8160
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:7932
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
        11⤵
        
        PID:5788
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetEnter.wpl" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:5940
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        10⤵
        
        PID:4196
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:2396
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        10⤵
        
        PID:2312
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:2396
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        10⤵
        
        PID:3400
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:3936
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        10⤵
        
        PID:4688
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:5220
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        10⤵
        
        PID:1180
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:5436
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        10⤵
        Possible privilege escalation attempt
        
        PID:6512
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:4020
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        10⤵
        
        PID:3776
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:928
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        10⤵
        
        PID:7612
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:7880
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        10⤵
        
        PID:6580
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:7708
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        10⤵
        
        PID:2168
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:7048
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
        10⤵
        
        PID:8212
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetEnter.wpl" /grant Administrators:F >nul 2>&1
        10⤵
        Modifies file permissions
        
        PID:10104
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        9⤵
        
        PID:2404
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:748
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        9⤵
        
        PID:2800
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:1200
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        9⤵
        
        PID:4988
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:3912
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        9⤵
        
        PID:1760
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:4868
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        9⤵
        
        PID:1052
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:1252
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        9⤵
        
        PID:5216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6288
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        9⤵
        
        PID:5132
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6696
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        9⤵
        
        PID:7028
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6924
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        9⤵
        
        PID:6648
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:5528
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        9⤵
        
        PID:5588
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:7408
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
        9⤵
        
        PID:9060
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetEnter.wpl" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetRestart.jpeg >nul 2>&1
        9⤵
        
        PID:8336
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetRestart.jpeg" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:4256
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        8⤵
        
        PID:3832
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:3576
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        8⤵
        
        PID:3408
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4368
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        8⤵
        
        PID:1052
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:3232
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        8⤵
        
        PID:2808
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:2292
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        8⤵
        
        PID:6024
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:5720
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        8⤵
        
        PID:1488
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        8⤵
        Possible privilege escalation attempt
        
        PID:6276
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        8⤵
        
        PID:5388
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6956
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        8⤵
        
        PID:5568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:5200
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        8⤵
        
        PID:6832
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:7496
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        8⤵
        
        PID:8920
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4752
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
        8⤵
        
        PID:8332
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetEnter.wpl" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:5656
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetRestart.jpeg >nul 2>&1
        8⤵
        
        PID:9676
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetRestart.jpeg" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6496
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        7⤵
        
        PID:1008
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:2836
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        7⤵
        
        PID:3764
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:4324
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        7⤵
        Modifies file permissions
        
        PID:3576
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:4436
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        7⤵
        
        PID:2776
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:1820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        7⤵
        
        PID:3084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        7⤵
        Modifies file permissions
        
        PID:6136
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        7⤵
        
        PID:6076
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:2836
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        7⤵
        
        PID:6856
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:408
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        7⤵
        
        PID:3728
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6696
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        7⤵
        
        PID:7480
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6428
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        7⤵
        
        PID:7632
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:9108
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
        7⤵
        
        PID:6612
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetEnter.wpl" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:8716
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetRestart.jpeg >nul 2>&1
        7⤵
        
        PID:7776
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetRestart.jpeg" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:8292
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        6⤵
        
        PID:3312
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:2788
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        6⤵
        
        PID:2980
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:4792
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        6⤵
        
        PID:4516
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:4648
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        6⤵
        Possible privilege escalation attempt
        
        PID:568
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:536
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        6⤵
        
        PID:2860
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:3056
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        6⤵
        
        PID:5588
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:2016
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        6⤵
        
        PID:2412
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:4264
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        6⤵
        
        PID:5820
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:5284
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        6⤵
        Possible privilege escalation attempt
        
        PID:1052
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:4800
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        6⤵
        
        PID:4436
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:7824
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
        6⤵
        
        PID:7636
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetEnter.wpl" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:7656
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetRestart.jpeg >nul 2>&1
        6⤵
        
        PID:6764
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetRestart.jpeg" /grant Administrators:F >nul 2>&1
        6⤵
        Modifies file permissions
        
        PID:5476
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ImportStep.vdw >nul 2>&1
        6⤵
        
        PID:7092
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ImportStep.vdw" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:9552
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\JoinGrant.rtf >nul 2>&1
        6⤵
        
        PID:5720
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        5⤵
        
        PID:3736
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:3108
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        5⤵
        
        PID:3884
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:1884
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
        5⤵
        
        PID:3316
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        5⤵
        Modifies file permissions
        
        PID:3300
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        5⤵
        
        PID:2760
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4472
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
        5⤵
        
        PID:872
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:1180
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
        5⤵
        
        PID:5356
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:1748
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
        5⤵
        
        PID:5252
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6164
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        5⤵
        
        PID:6076
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4256
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
        5⤵
        
        PID:5432
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6228
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
        5⤵
        
        PID:5628
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:7044
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
        5⤵
        
        PID:6820
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetEnter.wpl" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6828
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetRestart.jpeg >nul 2>&1
        5⤵
        
        PID:5376
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetRestart.jpeg" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:7696
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ImportStep.vdw >nul 2>&1
        5⤵
        
        PID:7264
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ImportStep.vdw" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:8304
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
      4⤵
      PID:4528
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
      4⤵
      PID:3728
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
      4⤵
      PID:2748
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
      4⤵
      PID:3300
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
      4⤵
      Possible privilege escalation attempt
      PID:1808
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
      4⤵
      PID:1204
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f >nul 2>&1
      4⤵
      PID:1188
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
      4⤵
      PID:2904
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
      4⤵
      PID:1224
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4200
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
      4⤵
      PID:4248
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
      4⤵
      PID:5372
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
      4⤵
      PID:3100
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
      4⤵
      PID:2760
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
      4⤵
      PID:6476
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
      4⤵
      PID:2100
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
      4⤵
      PID:928
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
      4⤵
      PID:5212
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
      4⤵
      PID:7496
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6184
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
      4⤵
      PID:4176
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\GetEnter.wpl" /grant Administrators:F >nul 2>&1
      4⤵
      PID:7236
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetRestart.jpeg >nul 2>&1
      4⤵
      PID:7704
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\GetRestart.jpeg" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6192
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ImportStep.vdw >nul 2>&1
      4⤵
      PID:7644
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ImportStep.vdw" /grant Administrators:F >nul 2>&1
      4⤵
      PID:7596
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\JoinGrant.rtf >nul 2>&1
      4⤵
      PID:8892
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
    3⤵
    PID:1096
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4664
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
    3⤵
    PID:628
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4944
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
    3⤵
    PID:5064
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
    3⤵
    PID:1108
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f >nul 2>&1
    3⤵
    PID:724
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
    3⤵
    PID:3952
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
    3⤵
    PID:2348
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5004
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
    3⤵
    PID:4196
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
    3⤵
    PID:1204
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
    3⤵
    PID:2728
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5332
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
    3⤵
    - Possible privilege escalation attempt
    PID:5464
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4816
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
    3⤵
    PID:5388
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5588
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
    3⤵
    PID:5332
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5904
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
    3⤵
    PID:6864
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\GetEnter.wpl" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5172
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetRestart.jpeg >nul 2>&1
    3⤵
    PID:5432
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\GetRestart.jpeg" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6744
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ImportStep.vdw >nul 2>&1
    3⤵
    PID:8464
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ImportStep.vdw" /grant Administrators:F >nul 2>&1
    3⤵
    PID:8636
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\JoinGrant.rtf >nul 2>&1
    3⤵
    PID:8520
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\JoinGrant.rtf" /grant Administrators:F >nul 2>&1
    3⤵
    PID:7248
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\MeasureRepair.wm >nul 2>&1
    3⤵
    - Possible privilege escalation attempt
    PID:6052
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\MeasureRepair.wm" /grant Administrators:F >nul 2>&1
    3⤵
    PID:1724
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
  2⤵
  PID:4552
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
  2⤵
  PID:3684
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
  2⤵
  PID:4808
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
  2⤵
  PID:3252
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini >nul 2>&1
  2⤵
  PID:3808
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini" /grant Administrators:F >nul 2>&1
  2⤵
  PID:2616
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  PID:3556
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5040
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\AddReceive.rtf >nul 2>&1
  2⤵
  PID:4224
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\AddReceive.rtf" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4236
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\chrome_installer.log >nul 2>&1
  2⤵
  PID:204
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\chrome_installer.log" /grant Administrators:F >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  PID:1616
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\DenyCheckpoint.rle >nul 2>&1
  2⤵
  PID:2404
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\DenyCheckpoint.rle" /grant Administrators:F >nul 2>&1
  2⤵
  PID:2708
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
  2⤵
  PID:5944
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
  2⤵
  PID:2344
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExportCheckpoint.htm >nul 2>&1
  2⤵
  PID:5720
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ExportCheckpoint.htm" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5612
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\FormatHide.i64 >nul 2>&1
  2⤵
  PID:6736
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\FormatHide.i64" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5648
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetEnter.wpl >nul 2>&1
  2⤵
  PID:6668
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\GetEnter.wpl" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5972
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetRestart.jpeg >nul 2>&1
  2⤵
  PID:6640
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\GetRestart.jpeg" /grant Administrators:F >nul 2>&1
  2⤵
  PID:1216
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ImportStep.vdw >nul 2>&1
  2⤵
  PID:9208
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ImportStep.vdw" /grant Administrators:F >nul 2>&1
  2⤵
  PID:8336
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\JoinGrant.rtf >nul 2>&1
  2⤵
  PID:8872
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\JoinGrant.rtf" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5732
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\MeasureRepair.wm >nul 2>&1
  2⤵
  PID:9368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a31d8d87abf7db54e5af159959ffb39655ef3b9838cf4cf3862ab9032cffa32f
MD5 bf1d07b6014e003b40d614772c316285
SHA1 b83cc0fe9b1c176330f64f0bbec9605df94578b8
SHA512 264b5b82b86b41d6416d85eba302e258bcaf8742440858f1d3f1ce1301a762de80c5af403afa6502341111ee2d8b8fdc034813a33fbdffca1c1bef4af1dff68f
TLSH
T15CD08030FE14F4D6E22711B6551447105E5849E321A38285F1344C1CDDBC445D6D5B97
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 429cc88d93d1d62f214cf18abc5108633fb43e078d43f6a911b75ab659b5f082
MD5 b7f22aa64ae7aa58cc120f4decb92025
SHA1 098d9f9621b07548e03f548532a9400671db7051
SHA512 2d206594f4b2ae275eb5bd166a35fbfad178acc557e364f261ea4a4a871db6c1edf7ad75e1355912743ea95e7e2d9f307011052aa357a7cc6160f80af36bb7f5
TLSH
T1B461B6750A9322B1EF14C63294DD025D3777C6F7FA1B6E8990809633761231EF325AAD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5978d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5978d0.TMP
Size 3KB
SHA256 9a1f0f958f2d8dd69f64f79b7c09b7539e0d685c2018e50ced673b2d74860956
MD5 f3f5e379eb97500d0d6081c79a1fbd84
SHA1 ede9154e659c8469c717184134b8d11fb334a2d8
SHA512 f2472edbf8686097b22c3475b1b568da76bca3d393352e575cdf625e89ea39f1783d2123f19de7463515b9dbd6691cb8fc03a2a5ec4a5560881495cb77990593
TLSH
T14261C5750A9322B1EF14C63294DD025D37B3C6F7FA1B6E8990805633761231EF3259AC
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 099132c4fcf51e3c139d65355da0dbadb41246b68c6e2f180fc1bdf7352da3dc
MD5 d1fdca674d014bd284f888b15dea215d
SHA1 fb67166c964d060008b8ba02e6b9da98b1c70de3
SHA512 90a8e3f05f81275ae85f43c4cc107ba6a27ca8daba5ae744126d776d2647d2a00fdec05f647f8cbf31a22e02efc48f780b047145db5a02d96a6ce86a83d8fb0f
TLSH
T180219AF7C3D4856E8A0116F4AA14AE1BCF2D0A05431C3C1AC9E4EF6B93E3475E10196F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7dd13872c0edf3daa2ed95f2ddc5abea0709a4275d070575fe9630c6c25cce31
MD5 ca1f003729276ebefceabd81d02f760e
SHA1 537bfea8fd797eed95d07ee1008b8ea64078576e
SHA512 d257d6bafeb2275ef89d54ac65ad50135405566dce3c1dad80ee7023dab8c01ed6e830c91b3bc3217d7aa3dd116a5b627c7b3609b5ef2ac9736a7fac5216dd58
SSDEEP 192:sxZbRnyM/jK1Ml8mjS/f9sSWpVS6TVYEdpd7HW6+WNGYPqjlbXIgEJ:sxZbBLS/f9sSWvS6BBHbGfZI
TLSH
T19352DA16AA38597BCCCBD20DFA557F53D6F91462A2901E449AFCCA1C01E6AEC2313C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 299610b8437f99a1dfcf351138d2021cc3bf8d92455cbda9beb4bbaf2cabd2ed
MD5 3742812c59dcf3540a5af586c4cb5fdd
SHA1 875187e125babc3b29d4774aa64ec4b695c2872f
SHA512 546ca858d02f322fc5e3b356ce9682dac864dcf7791c4000f740b26e0307abcf35854716005130700dbf46089e22e6bb32f00ff7b80a3b3bb9d63acd8ea8572f
SSDEEP 768:MKseJQxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTcLly0ppvroTF:MKseJQxWvhfynu1jaIcL88p8B
TLSH
T12FE2FB2B280CCB7E4F844E6DEC266F966EE801CB57944D5487EA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 91f6f028f77cc2958593711d2c8700bf73208487c9fea1c5a5b251e2b8c91fb7
MD5 d8739d18b8f041f93025c4849387dc55
SHA1 351fb2608738a3bfd5745a29688975a93e10db10
SHA512 0b94637ba7daaf1d062ecd9560773d5bb1f7d69152f9674e2b3c4dafb09b950ccd8c98d90f74c959d0d3901c0f15210e9e4336015cfa9284c7fa38d81d8253cc
SSDEEP 192:lONG6vMtPQmiUy0dThTobWCIKp847fLU/u:lONG6UtR1TiFIKRjU/u
TLSH
T17A020976BC686C7BAAA7BD45F48E23171FE4216FA5905B50EAE82F1C00D765C2303937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 ba18ec52dceed63fc09f08f9903eb04215bfa8c31cad761b39db223ee5e9d93c
MD5 9c13180bc5fff97a71d7d637fb374dbf
SHA1 333459f1fbd927b0f521efdc3c14ef682af06e7b
SHA512 06df39f412af1c61e24be409cd8ba386a438060197c22647c61fe0221fa8aec804556b63a2764892893aa55974a7b26ff7e0ec3651ea3668e191017ef964f03f
SSDEEP 384:zesNfiC7eomqzFIKPloJEVA8tkI1o/5mkc0Qf:y26gFxloJz8w/5U0Qf
TLSH
T1B28218B1E8A45DEB9496E5C9618AF1132DB4513BC68C5A0CF3F83B3D316F4B8530396A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b06617a3d0de2ba18e0508748f58fd04c3cd6e492c79c8ce8cc5086244403125
MD5 741cb2465033386f2e636750ec9af2cb
SHA1 8f40caceede070e4695e1ec4cee0228ecdcae782
SHA512 0e4830f4a5349ccabdccb990892674bcce40d605209820c3432bb10c67a483103712afc83a6fda301ec955c9f327703e2d194411c2246e5a115de95f2ff4c865
SSDEEP 192:BONS6vMQPQmiUyrddhTobWCIK++WyiG80IqqwvU/u:BONS6UQRkdiFIKPluEU/u
TLSH
T1B91218B1BC699C6B6DA7B111F4CE33535EA421BB99809F10FAD82F1C00D765C270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

60633436-5206-4333-ade3-2ed2c8908a8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\60633436-5206-4333-ade3-2ed2c8908a8d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 170640fd1d622df66dea41049ed2f5cd400c055b5b476a9fdad28f427c73d83f
MD5 b57e7f36b5cf6d080bdd923c8e9ee072
SHA1 6d722942964b4b264ab578c1e0cc58bf6b59b1dc
SHA512 c9cde6afe4d505da7094d54fd0b2a3ab3ba83d4ed62f82170a2a791ba2abe7b4e4642d63bdd2ea9e1a8f60755a9e036ce7e0b2188fdd36bf2e3d19df66655275
TLSH
T198414A5CB6FA1109B3B36E5BABF7986D487EBC371E46C45E10110E8E0667A40D862737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/10732-198-0x00000000045C0000-0x00000000045C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads