6eda82bafd06ea58a78653f22d17c094cb8e1fe62a3dfd28dc845e99e34a01fa

Analysis

user interaction
yes
max time kernel
0s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file01.vbs
Size 693B
Sample260717-w1e44set31
SHA256 6eda82bafd06ea58a78653f22d17c094cb8e1fe62a3dfd28dc845e99e34a01fa
MD5 26be4ef1cfa8a8f9e098c4307806347f
SHA1 91ed735611a0a465225924cf4295ec70771d7bde
SHA512 12a17ece9e95641802bf0330cda6435e86bfd1ac72899cf87adf4a92cf00c330368e5870a854f3c74648409f9c33dbabaaab23c06936ed5133e00e5fec1cfc66
TLSH
T1CD017D83BD4699625532DEB705A3A844D004C11B809AAE563ECC9180BF3775C98C54AC
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution exploit

Malware Config

Signatures

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
6496	takeown.exe
4472	Process not Found
7456	Process not Found
9184	Process not Found
8716	Process not Found
568	icacls.exe
6916	takeown.exe
3568	Process not Found
7380	Process not Found
7284	Process not Found
6736	Process not Found
8544	Process not Found
3204	Process not Found
824	Process not Found
6488	Process not Found
1688	Process not Found
5896	takeown.exe
2680	icacls.exe
4836	takeown.exe
7108	icacls.exe
2008	Process not Found
1776	Process not Found
1996	Process not Found
7404	Process not Found
4532	icacls.exe
2268	icacls.exe
2948	icacls.exe
7048	takeown.exe
7020	Process not Found
7812	Process not Found
5708	Process not Found
8780	Process not Found
5824	takeown.exe
7724	Process not Found
3204	Process not Found
796	Process not Found
4232	Process not Found
2864	takeown.exe
2216	icacls.exe
3368	icacls.exe
6940	takeown.exe
6932	icacls.exe
6560	takeown.exe
7788	Process not Found
7668	Process not Found
3768	takeown.exe
2788	icacls.exe
3412	icacls.exe
3784	takeown.exe
6352	icacls.exe
6580	Process not Found
6756	Process not Found
5436	Process not Found
8160	Process not Found
2240	Process not Found
5132	Process not Found
7668	Process not Found
7504	Process not Found
4328	Process not Found
7024	Process not Found
7216	Process not Found
1464	icacls.exe
4840	icacls.exe
6792	icacls.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3900	icacls.exe
1056	takeown.exe
6244	icacls.exe
7032	takeown.exe
3172	icacls.exe
7268	Process not Found
1068	Process not Found
1176	takeown.exe
4756	Process not Found
8096	Process not Found
7588	Process not Found
2336	Process not Found
1104	Process not Found
9132	Process not Found
8792	Process not Found
2628	icacls.exe
7260	Process not Found
1076	Process not Found
6428	Process not Found
8508	Process not Found
3832	Process not Found
1196	Process not Found
1480	icacls.exe
1120	icacls.exe
6848	Process not Found
6672	Process not Found
8132	Process not Found
5420	Process not Found
6864	Process not Found
6952	Process not Found
1008	icacls.exe
5948	takeown.exe
6976	takeown.exe
6256	icacls.exe
3124	Process not Found
2960	Process not Found
7460	Process not Found
7172	Process not Found
52	icacls.exe
1432	icacls.exe
6320	takeown.exe
6592	Process not Found
5748	Process not Found
7220	Process not Found
8312	Process not Found
5532	Process not Found
3528	takeown.exe
3292	icacls.exe
3244	Process not Found
1548	Process not Found
4748	Process not Found
4176	Process not Found
6900	Process not Found
3784	icacls.exe
7976	Process not Found
8056	Process not Found
7076	Process not Found
2424	Process not Found
8132	Process not Found
8508	Process not Found
5980	takeown.exe
4880	takeown.exe
7104	takeown.exe
7220	Process not Found

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
7796	Process not Found
7072	Process not Found
996	WScript.exe
6780	WScript.exe
1332	Process not Found
836	WScript.exe
7580	Process not Found
6264	Process not Found
5332	WScript.exe
2696	WScript.exe
5220	WScript.exe
4396	WScript.exe
4124	WScript.exe
4332	WScript.exe
1176	Process not Found
1016	Process not Found
2900	WScript.exe
4636	WScript.exe
4412	WScript.exe
4760	WScript.exe
5108	WScript.exe
6916	Process not Found
4472	Process not Found
6124	Process not Found
5404	WScript.exe
7144	WScript.exe
9192	Process not Found
2144	WScript.exe
4556	WScript.exe
4840	Process not Found
4312	WScript.exe
924	WScript.exe
472	WScript.exe
3068	WScript.exe
5148	WScript.exe
6512	WScript.exe
7412	Process not Found
1272	WScript.exe
1880	WScript.exe
4160	WScript.exe
3252	WScript.exe
6400	WScript.exe
6332	WScript.exe
6848	Process not Found
8136	Process not Found
7464	Process not Found
7316	Process not Found
2072	Process not Found
1804	WScript.exe
4824	WScript.exe
4108	WScript.exe
6368	WScript.exe
5528	Process not Found
2140	Process not Found
8052	Process not Found
7484	Process not Found
2804	Process not Found
5676	WScript.exe
1868	WScript.exe
4524	WScript.exe
6500	WScript.exe
6872	WScript.exe
6956	Process not Found
6772	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	WScript.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 4312	2900	WScript.exe	89
PID 2900 wrote to memory of 4356	2900	WScript.exe	90
PID 4312 wrote to memory of 4636	4312	WScript.exe	92
PID 4312 wrote to memory of 2296	4312	WScript.exe	4081
PID 2900 wrote to memory of 2216	2900	WScript.exe	5010

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4636
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:5332
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        5⤵
        
        PID:2380
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4412
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        8⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        9⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        10⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        11⤵
        
        PID:4364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        12⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        13⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        14⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        15⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3252
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        16⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        17⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        18⤵
        
        PID:572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        19⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        20⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        21⤵
        
        PID:5408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        22⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        23⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        24⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        25⤵
        
        PID:1992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        26⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5148
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        27⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        28⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        29⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        30⤵
        
        PID:2480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        31⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        32⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6512
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        33⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        34⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        35⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        36⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        37⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        38⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        39⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        40⤵
        
        PID:6708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        41⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        42⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        43⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        44⤵
        
        PID:6660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        45⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        46⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
        47⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5108
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        47⤵
        
        PID:5228
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        46⤵
        
        PID:6980
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        45⤵
        
        PID:6540
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        45⤵
        
        PID:5236
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        44⤵
        
        PID:6412
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        44⤵
        
        PID:6952
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        44⤵
        
        PID:6736
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        43⤵
        
        PID:2484
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        43⤵
        
        PID:6944
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        43⤵
        
        PID:3908
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        43⤵
        
        PID:1480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        42⤵
        
        PID:6892
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        42⤵
        
        PID:4580
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        42⤵
        
        PID:6816
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        42⤵
        
        PID:4756
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        42⤵
        
        PID:2672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        41⤵
        
        PID:4772
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:7116
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        41⤵
        
        PID:5632
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:6208
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        41⤵
        
        PID:6816
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:5840
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        40⤵
        
        PID:7100
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:3404
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        40⤵
        
        PID:6580
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:2720
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        40⤵
        
        PID:964
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:7096
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        40⤵
        
        PID:7100
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        39⤵
        
        PID:7116
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:1040
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        39⤵
        
        PID:5196
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:3280
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        39⤵
        
        PID:6224
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:6396
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        39⤵
        
        PID:6672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        38⤵
        
        PID:4116
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:7076
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        38⤵
        
        PID:6460
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:6880
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        38⤵
        
        PID:6564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:6384
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        38⤵
        
        PID:5956
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:6580
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        37⤵
        
        PID:6784
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:2408
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        37⤵
        
        PID:6424
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:6600
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        37⤵
        
        PID:5156
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:1344
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        37⤵
        
        PID:3368
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:5400
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        37⤵
        
        PID:4840
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        36⤵
        
        PID:4880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:7012
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        36⤵
        
        PID:3372
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:6668
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        36⤵
        
        PID:2268
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:1820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        36⤵
        
        PID:1068
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:1136
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        36⤵
        
        PID:7132
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:6680
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        36⤵
        
        PID:4840
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        35⤵
        Possible privilege escalation attempt
        
        PID:4836
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:6284
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        35⤵
        
        PID:6180
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:4552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        35⤵
        
        PID:6428
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:4424
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        35⤵
        
        PID:4140
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:6252
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        35⤵
        
        PID:3344
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        35⤵
        Modifies file permissions
        
        PID:3172
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        35⤵
        
        PID:6560
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        34⤵
        
        PID:5400
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:7004
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        34⤵
        
        PID:6928
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:2672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        34⤵
        
        PID:7088
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:4684
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        34⤵
        
        PID:6252
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:1776
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        34⤵
        Possible privilege escalation attempt
        
        PID:6560
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:3404
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        34⤵
        
        PID:6736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:6804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        34⤵
        
        PID:2904
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        33⤵
        
        PID:6288
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:1680
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        33⤵
        
        PID:2788
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:6724
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        33⤵
        
        PID:4204
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:6824
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        33⤵
        
        PID:6736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:6856
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        33⤵
        Possible privilege escalation attempt
        
        PID:7048
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:5976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        33⤵
        
        PID:5832
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:6840
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        33⤵
        
        PID:6192
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        32⤵
        
        PID:6988
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:6636
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        32⤵
        
        PID:6716
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:6444
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        32⤵
        
        PID:1352
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        32⤵
        Modifies file permissions
        
        PID:6244
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        32⤵
        
        PID:7048
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:1700
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        32⤵
        
        PID:4880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:6712
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        32⤵
        
        PID:5532
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:6676
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        32⤵
        
        PID:5436
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        31⤵
        
        PID:4360
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:3704
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        31⤵
        Modifies file permissions
        
        PID:6976
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:3848
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        31⤵
        
        PID:6740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:1056
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        31⤵
        
        PID:6832
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:6760
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        31⤵
        
        PID:6312
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:2284
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        31⤵
        
        PID:3772
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:2216
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        31⤵
        
        PID:1984
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        31⤵
        Modifies file permissions
        
        PID:2628
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        31⤵
        
        PID:6760
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        30⤵
        
        PID:4248
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:6392
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        30⤵
        
        PID:4436
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:7088
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        30⤵
        
        PID:824
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:6564
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        30⤵
        
        PID:884
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:6808
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        30⤵
        
        PID:7108
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:1012
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        30⤵
        
        PID:4188
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:5704
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        30⤵
        
        PID:3100
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:2008
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        30⤵
        
        PID:6628
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:556
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        29⤵
        
        PID:5564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:6024
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        29⤵
        
        PID:6304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:3280
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        29⤵
        
        PID:6152
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:3584
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        29⤵
        
        PID:6524
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:5724
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        29⤵
        
        PID:4244
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:6280
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        29⤵
        
        PID:6836
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:6084
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        29⤵
        
        PID:6352
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:6552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        29⤵
        
        PID:6880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:6596
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        29⤵
        
        PID:6088
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        28⤵
        
        PID:568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:5556
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        28⤵
        
        PID:3616
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:6568
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        28⤵
        
        PID:1276
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:3372
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        28⤵
        
        PID:7044
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:5732
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        28⤵
        
        PID:6304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:5496
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        28⤵
        
        PID:6128
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:3600
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        28⤵
        
        PID:3896
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:5388
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        28⤵
        
        PID:6840
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:4116
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        28⤵
        Possible privilege escalation attempt
        
        PID:6916
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        27⤵
        
        PID:3584
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:5196
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        27⤵
        
        PID:4176
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:4176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        27⤵
        
        PID:2936
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6344
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        27⤵
        
        PID:4500
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6020
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        27⤵
        
        PID:5520
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6668
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        27⤵
        
        PID:5388
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:2936
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        27⤵
        
        PID:6804
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:1516
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        27⤵
        
        PID:7064
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:4176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        27⤵
        
        PID:796
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:5632
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        26⤵
        
        PID:1484
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:4704
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        26⤵
        
        PID:2912
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:304
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        26⤵
        
        PID:3044
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6648
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        26⤵
        
        PID:6496
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:4304
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        26⤵
        
        PID:204
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6736
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        26⤵
        
        PID:944
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:1512
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        26⤵
        
        PID:4532
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:5368
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        26⤵
        
        PID:6364
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6488
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        26⤵
        
        PID:6192
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        26⤵
        
        PID:4132
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        25⤵
        
        PID:944
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:3808
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        25⤵
        
        PID:1344
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        25⤵
        Possible privilege escalation attempt
        
        PID:2268
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        25⤵
        
        PID:2340
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:4552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        25⤵
        
        PID:7144
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6580
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        25⤵
        
        PID:6368
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:3412
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        25⤵
        
        PID:6268
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6924
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        25⤵
        
        PID:6756
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        25⤵
        
        PID:5516
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        25⤵
        
        PID:4748
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:5532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        25⤵
        
        PID:3368
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:4204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        24⤵
        
        PID:5564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        24⤵
        Modifies file permissions
        
        PID:1120
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        24⤵
        
        PID:4704
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        24⤵
        Possible privilege escalation attempt
        
        PID:3412
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        24⤵
        
        PID:1120
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:1040
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        24⤵
        
        PID:3412
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:6716
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        24⤵
        
        PID:6668
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:4368
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        24⤵
        
        PID:6500
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:4232
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        24⤵
        
        PID:1176
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:4176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        24⤵
        
        PID:6464
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        24⤵
        Possible privilege escalation attempt
        
        PID:7108
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        24⤵
        
        PID:4832
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:6772
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        24⤵
        
        PID:1352
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:6892
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        24⤵
        
        PID:4464
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        23⤵
        
        PID:2828
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:4624
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        23⤵
        
        PID:2060
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:5776
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        23⤵
        
        PID:1476
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:1276
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        23⤵
        
        PID:2884
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:1740
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        23⤵
        
        PID:4248
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:1928
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        23⤵
        
        PID:1040
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:6248
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        23⤵
        
        PID:6764
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:5520
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        23⤵
        
        PID:6972
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:6308
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        23⤵
        
        PID:6376
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:6308
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        23⤵
        
        PID:1808
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:7116
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        23⤵
        
        PID:6876
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:4500
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        22⤵
        
        PID:4936
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:4368
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        22⤵
        
        PID:3424
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:2284
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        22⤵
        
        PID:4580
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:824
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        22⤵
        
        PID:1120
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:5520
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        22⤵
        
        PID:6868
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:5436
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        22⤵
        
        PID:6536
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6396
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        22⤵
        
        PID:6424
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6528
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        22⤵
        
        PID:6868
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6528
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        22⤵
        
        PID:568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        22⤵
        
        PID:1692
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:824
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        22⤵
        Possible privilege escalation attempt
        
        PID:6496
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:3616
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        21⤵
        
        PID:864
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:4612
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        21⤵
        
        PID:2780
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:4540
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        21⤵
        
        PID:5068
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:1152
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        21⤵
        
        PID:4204
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:1700
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        21⤵
        
        PID:1776
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:2792
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        21⤵
        Possible privilege escalation attempt
        
        PID:6940
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:6888
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        21⤵
        
        PID:6752
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:4188
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        21⤵
        
        PID:4936
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:6588
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        21⤵
        
        PID:6724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:4560
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        21⤵
        
        PID:824
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:6524
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        21⤵
        
        PID:6036
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:1484
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        21⤵
        
        PID:1712
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        20⤵
        
        PID:1432
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:796
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        20⤵
        
        PID:304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:1852
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        20⤵
        
        PID:2672
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:4844
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        20⤵
        
        PID:4596
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:4808
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        20⤵
        
        PID:5880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        20⤵
        Modifies file permissions
        
        PID:3784
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        20⤵
        Modifies file permissions
        
        PID:6320
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        20⤵
        Modifies file permissions
        
        PID:3292
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        20⤵
        
        PID:1748
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        20⤵
        Possible privilege escalation attempt
        
        PID:6932
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        20⤵
        
        PID:5580
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:6356
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        20⤵
        
        PID:1984
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:4204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        20⤵
        
        PID:2844
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:1100
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        20⤵
        
        PID:5516
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:6836
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        20⤵
        
        PID:6472
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:6228
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        20⤵
        
        PID:6956
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        19⤵
        
        PID:2424
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:4976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        19⤵
        
        PID:6096
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:3404
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        19⤵
        
        PID:3608
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:6048
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        19⤵
        
        PID:932
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:4820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        19⤵
        
        PID:1680
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:5520
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        19⤵
        
        PID:568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:4268
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        19⤵
        
        PID:6996
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:6548
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        19⤵
        
        PID:6428
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:6796
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        19⤵
        
        PID:2268
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        19⤵
        
        PID:6924
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:6524
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        19⤵
        
        PID:6204
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:5224
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        19⤵
        
        PID:3616
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:7068
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        19⤵
        
        PID:4244
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:6920
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        18⤵
        
        PID:5388
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:3900
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        18⤵
        
        PID:5972
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:1164
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        18⤵
        
        PID:5704
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:5820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        18⤵
        
        PID:1692
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:5704
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        18⤵
        
        PID:304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        18⤵
        Possible privilege escalation attempt
        
        PID:2680
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        18⤵
        
        PID:4832
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:3100
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        18⤵
        
        PID:6428
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:6392
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        18⤵
        
        PID:6508
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:6976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        18⤵
        
        PID:6368
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:6628
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        18⤵
        
        PID:5532
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:7068
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        18⤵
        
        PID:4400
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:1512
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        18⤵
        
        PID:5196
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:6496
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        18⤵
        
        PID:6300
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:4400
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        18⤵
        
        PID:6792
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        17⤵
        
        PID:3848
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:6032
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        17⤵
        
        PID:5880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:4532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        17⤵
        
        PID:1212
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        17⤵
        Modifies file permissions
        
        PID:1432
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        17⤵
        
        PID:1716
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:2484
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        17⤵
        
        PID:4808
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:5916
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        17⤵
        
        PID:3808
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:3904
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        17⤵
        
        PID:4304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:6468
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        17⤵
        
        PID:6340
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:6664
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        17⤵
        
        PID:6164
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:6252
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        17⤵
        
        PID:6544
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:6672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        17⤵
        
        PID:6176
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:6424
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        17⤵
        
        PID:1368
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:6896
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        17⤵
        
        PID:6360
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:1352
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        17⤵
        
        PID:7132
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        16⤵
        
        PID:2684
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:2124
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        16⤵
        
        PID:3244
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:3260
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        16⤵
        
        PID:1364
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        16⤵
        Possible privilege escalation attempt
        
        PID:4840
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        16⤵
        Modifies file permissions
        
        PID:1056
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:3696
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        16⤵
        
        PID:1072
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:4452
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        16⤵
        
        PID:2880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:2216
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        16⤵
        
        PID:2800
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:5368
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        16⤵
        
        PID:3772
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:1012
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        16⤵
        
        PID:2828
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        16⤵
        
        PID:6920
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6460
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        16⤵
        
        PID:7076
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6268
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        16⤵
        
        PID:884
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:7100
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        16⤵
        
        PID:1516
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6152
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        16⤵
        
        PID:3244
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:3532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        15⤵
        
        PID:1100
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        15⤵
        Modifies file permissions
        
        PID:3900
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        15⤵
        
        PID:3340
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:5984
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        15⤵
        
        PID:4740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:1804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        15⤵
        
        PID:1264
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:2124
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        15⤵
        
        PID:4740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:2136
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        15⤵
        
        PID:3532
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:3784
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        15⤵
        
        PID:4304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:1148
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        15⤵
        
        PID:1960
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        15⤵
        Possible privilege escalation attempt
        
        PID:3368
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        15⤵
        
        PID:3384
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:6812
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        15⤵
        
        PID:6332
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:4832
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        15⤵
        
        PID:5576
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:4540
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        15⤵
        
        PID:4188
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:6976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        15⤵
        
        PID:2992
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:6680
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        15⤵
        
        PID:7032
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:6372
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
        15⤵
        
        PID:1392
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:4688
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
        15⤵
        
        PID:5544
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:6756
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        14⤵
        
        PID:3904
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:4500
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        14⤵
        
        PID:1332
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:3908
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        14⤵
        
        PID:1344
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:2912
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        14⤵
        
        PID:2884
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:5016
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        14⤵
        
        PID:5804
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:2484
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        14⤵
        
        PID:2556
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:2612
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        14⤵
        
        PID:3532
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:3292
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        14⤵
        
        PID:5436
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:1744
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        14⤵
        
        PID:1164
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:824
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        14⤵
        
        PID:204
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:6332
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        14⤵
        
        PID:4500
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:6312
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        14⤵
        
        PID:6988
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:3440
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        14⤵
        
        PID:6984
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        14⤵
        Possible privilege escalation attempt
        
        PID:6792
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        14⤵
        
        PID:6704
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:2992
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
        14⤵
        
        PID:6968
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:1100
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        13⤵
        
        PID:4592
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:4876
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        13⤵
        
        PID:952
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:4472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        13⤵
        
        PID:5520
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        13⤵
        Modifies file permissions
        
        PID:1480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        13⤵
        
        PID:5196
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:4540
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        13⤵
        
        PID:2788
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:1352
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        13⤵
        
        PID:1916
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:2948
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        13⤵
        
        PID:4612
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:2936
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        13⤵
        
        PID:6084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:5532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        13⤵
        
        PID:2896
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:3848
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        13⤵
        
        PID:6620
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:6348
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        13⤵
        
        PID:440
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:864
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        13⤵
        
        PID:7096
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:6468
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        13⤵
        
        PID:6448
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:5812
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        13⤵
        
        PID:2336
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:5520
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
        13⤵
        
        PID:4248
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:7048
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
        13⤵
        
        PID:2336
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:2824
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        12⤵
        
        PID:2484
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:3304
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        12⤵
        
        PID:6024
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:3588
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        12⤵
        
        PID:1928
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:6084
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        12⤵
        
        PID:1760
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:2040
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        12⤵
        
        PID:1592
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:4500
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        12⤵
        
        PID:4832
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:1656
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        12⤵
        
        PID:4268
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:1856
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        12⤵
        
        PID:2844
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:2884
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        12⤵
        
        PID:1852
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:2612
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        12⤵
        
        PID:2612
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:3292
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        12⤵
        
        PID:7084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:796
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        12⤵
        
        PID:1100
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:568
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        12⤵
        
        PID:6296
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:124
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        12⤵
        
        PID:6888
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:1008
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
        12⤵
        
        PID:2948
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:6020
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
        12⤵
        
        PID:2824
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:6520
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResizeAdd.TS >nul 2>&1
        12⤵
        
        PID:4280
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        11⤵
        Possible privilege escalation attempt
        
        PID:2864
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:4248
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        11⤵
        
        PID:572
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:2792
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        11⤵
        
        PID:5032
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:4104
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        11⤵
        
        PID:5972
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:1700
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        11⤵
        
        PID:6092
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:5068
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        11⤵
        Modifies file permissions
        
        PID:3528
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:5744
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        11⤵
        Modifies file permissions
        
        PID:5948
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:4436
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        11⤵
        
        PID:2856
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:4124
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        11⤵
        
        PID:2488
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:3368
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        11⤵
        
        PID:4580
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:4936
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        11⤵
        
        PID:5544
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:4080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        11⤵
        
        PID:6312
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:6568
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        11⤵
        
        PID:6224
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:1616
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        11⤵
        
        PID:3960
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:6712
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
        11⤵
        
        PID:2612
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:6952
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
        11⤵
        
        PID:1640
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:964
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResizeAdd.TS >nul 2>&1
        11⤵
        
        PID:6656
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResizeAdd.TS" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:756
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResumeSend.mov >nul 2>&1
        11⤵
        
        PID:2072
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        10⤵
        
        PID:4324
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:5900
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        10⤵
        
        PID:1348
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        10⤵
        Modifies file permissions
        
        PID:52
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        10⤵
        
        PID:5748
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:2844
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        10⤵
        
        PID:3544
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:2488
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        10⤵
        
        PID:1960
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:1212
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        10⤵
        
        PID:4612
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:1476
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        10⤵
        
        PID:1960
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:4684
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        10⤵
        
        PID:1464
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:2856
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        10⤵
        
        PID:1164
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:5564
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        10⤵
        
        PID:5156
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        10⤵
        Possible privilege escalation attempt
        
        PID:2948
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        10⤵
        
        PID:1152
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:6092
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        10⤵
        
        PID:6852
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:5856
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        10⤵
        
        PID:3340
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:2424
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        10⤵
        
        PID:4468
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:2008
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
        10⤵
        
        PID:1712
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:200
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
        10⤵
        
        PID:6268
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:6972
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResizeAdd.TS >nul 2>&1
        10⤵
        Modifies file permissions
        
        PID:7032
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResizeAdd.TS" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:6360
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResumeSend.mov >nul 2>&1
        10⤵
        
        PID:3848
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        9⤵
        
        PID:2564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:3696
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        9⤵
        
        PID:5748
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:4352
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        9⤵
        
        PID:4836
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:4396
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        9⤵
        
        PID:6076
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:3216
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        9⤵
        
        PID:6048
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:1856
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        9⤵
        
        PID:3784
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:1152
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        9⤵
        
        PID:1964
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:2336
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        9⤵
        
        PID:1692
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:1980
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        9⤵
        
        PID:5900
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:2180
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        9⤵
        
        PID:2856
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:4080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        9⤵
        
        PID:4868
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:1692
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        9⤵
        
        PID:6576
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:5532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        9⤵
        
        PID:7152
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:2936
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        9⤵
        
        PID:6848
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:1820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
        9⤵
        
        PID:5020
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:1072
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
        9⤵
        
        PID:6248
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6760
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResizeAdd.TS >nul 2>&1
        9⤵
        
        PID:3896
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResizeAdd.TS" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:7008
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResumeSend.mov >nul 2>&1
        9⤵
        
        PID:7072
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResumeSend.mov" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:2088
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        8⤵
        
        PID:1044
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:1460
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        8⤵
        
        PID:5856
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:3916
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        8⤵
        
        PID:2016
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4336
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        8⤵
        
        PID:3524
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:2924
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        8⤵
        
        PID:4740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:1820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        8⤵
        
        PID:4216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:3956
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        8⤵
        
        PID:1728
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:3400
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        8⤵
        
        PID:2880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4400
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        8⤵
        
        PID:3144
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:5016
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        8⤵
        
        PID:1476
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:2124
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        8⤵
        
        PID:5112
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4324
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        8⤵
        
        PID:1960
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:7032
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        8⤵
        Possible privilege escalation attempt
        
        PID:3784
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6768
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        8⤵
        
        PID:7156
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:3412
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
        8⤵
        
        PID:5900
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6236
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
        8⤵
        
        PID:4684
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6864
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResizeAdd.TS >nul 2>&1
        8⤵
        
        PID:5732
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResizeAdd.TS" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4464
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResumeSend.mov >nul 2>&1
        8⤵
        
        PID:6756
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResumeSend.mov" /grant Administrators:F >nul 2>&1
        8⤵
        Possible privilege escalation attempt
        
        PID:6352
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\TraceCopy.ico >nul 2>&1
        8⤵
        
        PID:6352
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        7⤵
        
        PID:1056
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:2960
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        7⤵
        
        PID:3564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:2852
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        7⤵
        
        PID:5236
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:2408
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        7⤵
        
        PID:4080
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:1656
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        7⤵
        
        PID:932
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:5556
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        7⤵
        
        PID:2240
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:1076
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        7⤵
        
        PID:4936
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6128
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        7⤵
        
        PID:52
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:2216
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        7⤵
        
        PID:3372
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:5196
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        7⤵
        
        PID:864
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:1176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        7⤵
        
        PID:2484
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:2880
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        7⤵
        
        PID:4108
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:3752
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        7⤵
        
        PID:2536
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:3616
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        7⤵
        
        PID:1964
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6992
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
        7⤵
        
        PID:4304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
        7⤵
        Modifies file permissions
        
        PID:6256
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
        7⤵
        
        PID:6680
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6772
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResizeAdd.TS >nul 2>&1
        7⤵
        
        PID:3100
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResizeAdd.TS" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6684
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResumeSend.mov >nul 2>&1
        7⤵
        
        PID:6944
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResumeSend.mov" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6760
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\TraceCopy.ico >nul 2>&1
        7⤵
        
        PID:4540
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\TraceCopy.ico" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:5016
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\UninstallDisconnect.wdp >nul 2>&1
        7⤵
        
        PID:6552
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        6⤵
        
        PID:1852
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:4340
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        6⤵
        
        PID:1748
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        6⤵
        Possible privilege escalation attempt
        
        PID:4532
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        6⤵
        
        PID:3124
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:5556
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        6⤵
        
        PID:4468
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:4232
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        6⤵
        
        PID:796
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        6⤵
        Possible privilege escalation attempt
        
        PID:1464
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        6⤵
        
        PID:5956
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:3768
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        6⤵
        
        PID:2056
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:4248
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        6⤵
        
        PID:4324
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:2880
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        6⤵
        
        PID:3780
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        6⤵
        Possible privilege escalation attempt
        
        PID:2788
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        6⤵
        
        PID:1820
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:3640
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        6⤵
        
        PID:1040
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:2136
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        6⤵
        Modifies file permissions
        
        PID:5980
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        6⤵
        Possible privilege escalation attempt
        
        PID:2216
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        6⤵
        
        PID:4280
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:4436
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        6⤵
        
        PID:6652
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:6520
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
        6⤵
        
        PID:4808
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:5812
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
        6⤵
        
        PID:440
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:6384
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResizeAdd.TS >nul 2>&1
        6⤵
        
        PID:2912
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResizeAdd.TS" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:6284
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResumeSend.mov >nul 2>&1
        6⤵
        
        PID:4248
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResumeSend.mov" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:6984
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\TraceCopy.ico >nul 2>&1
        6⤵
        Modifies file permissions
        
        PID:7104
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\TraceCopy.ico" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:6664
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\UninstallDisconnect.wdp >nul 2>&1
        6⤵
        
        PID:7004
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\UninstallDisconnect.wdp" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:3160
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        5⤵
        
        PID:1104
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:2684
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        5⤵
        
        PID:4596
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:5072
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        5⤵
        
        PID:5472
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:472
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        5⤵
        
        PID:2828
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:3584
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
        5⤵
        
        PID:3272
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        5⤵
        Possible privilege escalation attempt
        
        PID:568
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        5⤵
        
        PID:944
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4668
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
        5⤵
        
        PID:5916
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:472
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        5⤵
        
        PID:3588
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:1776
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
        5⤵
        
        PID:1856
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4684
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
        5⤵
        
        PID:3208
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:2792
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
        5⤵
        
        PID:4688
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:5928
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
        5⤵
        
        PID:2620
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4748
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
        5⤵
        
        PID:5580
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:2284
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
        5⤵
        
        PID:2620
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:2304
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
        5⤵
        
        PID:4440
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:5496
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
        5⤵
        
        PID:3344
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:3424
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResizeAdd.TS >nul 2>&1
        5⤵
        
        PID:6712
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResizeAdd.TS" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:884
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResumeSend.mov >nul 2>&1
        5⤵
        
        PID:7140
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResumeSend.mov" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6220
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\TraceCopy.ico >nul 2>&1
        5⤵
        
        PID:6228
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\TraceCopy.ico" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6084
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\UninstallDisconnect.wdp >nul 2>&1
        5⤵
        
        PID:6564
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\UninstallDisconnect.wdp" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6220
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\UseMount.txt >nul 2>&1
        5⤵
        
        PID:1748
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
      4⤵
      PID:3124
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4196
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
      4⤵
      PID:2304
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4472
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
      4⤵
      PID:2720
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
      4⤵
      PID:1432
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
      4⤵
      PID:632
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4172
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
      4⤵
      PID:4268
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
      4⤵
      PID:1072
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f >nul 2>&1
      4⤵
      PID:4860
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
      4⤵
      PID:2432
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
      4⤵
      PID:1488
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
      4⤵
      PID:2256
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
      4⤵
      PID:5060
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
      4⤵
      PID:5880
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
      4⤵
      PID:944
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
      4⤵
      PID:3412
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
      4⤵
      PID:3340
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4540
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
      4⤵
      PID:1712
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
      4⤵
      PID:5060
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
      4⤵
      PID:3404
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
      4⤵
      PID:3372
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
      4⤵
      PID:5948
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
      4⤵
      PID:5860
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
      4⤵
      PID:3848
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
      4⤵
      PID:1120
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
      4⤵
      PID:6384
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
      4⤵
      PID:1040
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
      4⤵
      PID:3772
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6392
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResizeAdd.TS >nul 2>&1
      4⤵
      PID:6644
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ResizeAdd.TS" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6876
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResumeSend.mov >nul 2>&1
      4⤵
      PID:6964
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ResumeSend.mov" /grant Administrators:F >nul 2>&1
      4⤵
      PID:7052
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\TraceCopy.ico >nul 2>&1
      4⤵
      PID:4832
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\TraceCopy.ico" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6128
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\UninstallDisconnect.wdp >nul 2>&1
      4⤵
      PID:6840
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\UninstallDisconnect.wdp" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4936
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\UseMount.txt >nul 2>&1
      4⤵
      PID:7044
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\UseMount.txt" /grant Administrators:F >nul 2>&1
      4⤵
      PID:5832
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
    3⤵
    PID:2296
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4956
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
    3⤵
    PID:4336
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5916
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
    3⤵
    - Possible privilege escalation attempt
    PID:5896
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
    3⤵
    PID:1116
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
    3⤵
    PID:4640
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6096
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
    3⤵
    - Possible privilege escalation attempt
    PID:3768
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
    3⤵
    PID:3960
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f >nul 2>&1
    3⤵
    PID:4176
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
    3⤵
    PID:3564
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
    3⤵
    PID:2180
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
    3⤵
    PID:2308
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
    3⤵
    - Possible privilege escalation attempt
    PID:5824
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4988
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
    3⤵
    PID:4116
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6088
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
    3⤵
    PID:5204
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
    3⤵
    PID:2856
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
    3⤵
    PID:1104
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4532
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
    3⤵
    PID:4204
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
    3⤵
    PID:1960
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
    3⤵
    PID:4936
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4080
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
    3⤵
    PID:4704
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5900
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
    3⤵
    PID:6084
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
    3⤵
    PID:1120
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
    3⤵
    PID:3900
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6356
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResizeAdd.TS >nul 2>&1
    3⤵
    PID:1344
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ResizeAdd.TS" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6152
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResumeSend.mov >nul 2>&1
    3⤵
    PID:6212
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ResumeSend.mov" /grant Administrators:F >nul 2>&1
    3⤵
    PID:3088
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\TraceCopy.ico >nul 2>&1
    3⤵
    PID:6156
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\TraceCopy.ico" /grant Administrators:F >nul 2>&1
    3⤵
    PID:7132
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\UninstallDisconnect.wdp >nul 2>&1
    3⤵
    PID:6220
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\UninstallDisconnect.wdp" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6128
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\UseMount.txt >nul 2>&1
    3⤵
    PID:6924
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\UseMount.txt" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6532
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\7-Zip\7-zip.chm >nul 2>&1
    3⤵
    PID:5540
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
  2⤵
  PID:4356
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
  2⤵
  PID:2216
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
  2⤵
  PID:1484
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
  2⤵
  PID:3380
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
  2⤵
  PID:4800
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
  2⤵
  - Modifies file permissions
  PID:1008
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
  2⤵
  PID:4372
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
  2⤵
  PID:3716
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini >nul 2>&1
  2⤵
  PID:3684
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4808
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f >nul 2>&1
  2⤵
  PID:5724
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4220
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveGet.svgz >nul 2>&1
  2⤵
  PID:5352
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveGet.svgz" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4808
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
  2⤵
  PID:4868
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
  2⤵
  PID:2144
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExitUnpublish.M2TS >nul 2>&1
  2⤵
  PID:5948
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ExitUnpublish.M2TS" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5860
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\GetCompress.crw >nul 2>&1
  2⤵
  PID:5956
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\GetCompress.crw" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4736
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\LockPing.asf >nul 2>&1
  2⤵
  PID:6032
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\LockPing.asf" /grant Administrators:F >nul 2>&1
  2⤵
  PID:3848
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountConvertFrom.3g2 >nul 2>&1
  2⤵
  PID:4188
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\MountConvertFrom.3g2" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5204
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\NewDisconnect.docx >nul 2>&1
  2⤵
  PID:5804
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\NewDisconnect.docx" /grant Administrators:F >nul 2>&1
  2⤵
  PID:1716
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenShow.csv >nul 2>&1
  2⤵
  PID:1916
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenShow.csv" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4372
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ReadStep.au3 >nul 2>&1
  2⤵
  PID:2408
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ReadStep.au3" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4552
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\RenameReceive.pub >nul 2>&1
  2⤵
  PID:5948
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\RenameReceive.pub" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6912
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResizeAdd.TS >nul 2>&1
  2⤵
  PID:1712
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ResizeAdd.TS" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6352
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResumeSend.mov >nul 2>&1
  2⤵
  PID:6880
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ResumeSend.mov" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6864
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\TraceCopy.ico >nul 2>&1
  2⤵
  PID:6332
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\TraceCopy.ico" /grant Administrators:F >nul 2>&1
  2⤵
  PID:7132
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\UninstallDisconnect.wdp >nul 2>&1
  2⤵
  PID:4964
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\UninstallDisconnect.wdp" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5496
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\UseMount.txt >nul 2>&1
  2⤵
  - Modifies file permissions
  PID:1176
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\UseMount.txt" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6916
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\7-Zip\7-zip.chm >nul 2>&1
  2⤵
  PID:4488
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\7-Zip\7-zip.chm" /grant Administrators:F >nul 2>&1
  2⤵
  PID:2424
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\7-Zip\7-zip.dll >nul 2>&1
  2⤵
  - Modifies file permissions
  PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 290B
SHA256 ca56a46e66b5f9b0685b4a89ab7938e5a5b37036d78c03042a0ab8230a638195
MD5 fde0360b3fbd6fa5049c5f11488e6cd3
SHA1 b477c72801b23710b7e3499f27fa873f2f949fa6
SHA512 66a518e1171bbc4df076889d232770e688fd25d1eadb618a63f8d1485390dfe9ea14800800c5c6cce804bfa472f2c925f27b0399b75f8408670bbc79500b27ab
TLSH
T139D0BD9F4335CFE083BCA1BA7930CCE4ABF38828C621102664EC5DA62C64A63518BA04
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 2KB
SHA256 d166efb6f683e89eb833ba4e8fcedad183ddc860369386ea1a4beb98b0f5ff84
MD5 26cf609293d2025369366092d94e35cf
SHA1 3dd8bb2ba6e35ce7933feedb0b8eb35fd2060976
SHA512 3adcbcf4f4daf2176921dce543d3bf7f0ec167b72256ed882b836abfece4d8f1612e67b1e5159b62963fb811691f93705cc7a1f4854583d29f938ffd1b17e25e
TLSH
T140510102CB8B2F1AC05942726E3983A6EB71B911F714821FB1C4895F7C764108A9DF5E
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 2KB
SHA256 ee24ad8f7cadcd18fa0f7f6eda741e4aedf5da3789dd0a0968bd8d2124deaac3
MD5 a3fb32a03e14d26f9892bd240192c1fb
SHA1 50de05578974ca5b2adbe2676353eb8fd1e8effe
SHA512 aaa87f4536f0c8360143252397bfd15d9006f7613f4198fd1478623464906946498304d80f7de713c7e6ccc3f12539b9423506c4dd867bb23e062da6664b97e8
TLSH
T132510102CB8B2F1AC05942726E3983A6EB71B911F714821FB1C4895F7C764108A9DF5E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6088-0-0x00007FFC62160000-0x00007FFC62170000-memory.dmp

Download

memory/6088-3-0x00007FFC62160000-0x00007FFC62170000-memory.dmp

Download

memory/6088-1-0x00007FFC62160000-0x00007FFC62170000-memory.dmp

Download

memory/6088-6-0x00007FFC5FC50000-0x00007FFC5FC60000-memory.dmp

Download

memory/6088-5-0x00007FFC5FC50000-0x00007FFC5FC60000-memory.dmp

Download

memory/6088-4-0x00007FFC62160000-0x00007FFC62170000-memory.dmp

Download

memory/6088-2-0x00007FFC62160000-0x00007FFC62170000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads