b5bed5199dcc80345af6c2a5748676b2d9cc523471a2cb3be9ef8b5f3f9a806e

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
script.vbs
Size 1KB
Sample260717-w3vbtaaw2p
SHA256 b5bed5199dcc80345af6c2a5748676b2d9cc523471a2cb3be9ef8b5f3f9a806e
MD5 37e4459ed9ee6264ba23c1c924eecf89
SHA1 996c81dd61abd88616bfcccf701a471f5cd646c3
SHA512 301abb56629434a71c4154bed356a70e7c32a6a79371993133648a77d710ea4af08010b4a0930d75b868390d78b55df0800635b354bada1c54d043abba20c023
TLSH
T1F51114837E0199B37171FBB1055BA800C365C21B605A9FA73DDC5040AF3778CC4A44DD
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution exploit trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WScript.exe

Disables Task Manager via registry modification
defense_evasion

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
8324	Process not Found
7156	Process not Found
9348	Process not Found
9236	Process not Found
10212	Process not Found
832	Process not Found
7100	Process not Found
7064	takeown.exe
9204	Process not Found
4668	Process not Found
2908	Process not Found
988	Process not Found
5736	takeown.exe
7572	Process not Found
9084	Process not Found
10008	Process not Found
9484	Process not Found
9592	Process not Found
1072	takeown.exe
8896	Process not Found
8600	Process not Found
1524	icacls.exe
2976	icacls.exe
6684	icacls.exe
6356	Process not Found
3252	Process not Found
4760	Process not Found
7284	Process not Found
7348	Process not Found
7608	icacls.exe
6680	takeown.exe
2492	icacls.exe
2436	Process not Found
3120	Process not Found
4396	Process not Found
10112	Process not Found
9572	Process not Found
8556	Process not Found
6896	Process not Found
10176	Process not Found
4356	Process not Found
4580	icacls.exe
8176	Process not Found
8852	Process not Found
1232	Process not Found
6820	Process not Found
2132	Process not Found
7356	Process not Found
9540	Process not Found
6112	takeown.exe
5096	icacls.exe
1756	icacls.exe
4340	takeown.exe
5144	Process not Found
9164	Process not Found
9344	Process not Found
5740	Process not Found
3712	icacls.exe
4180	icacls.exe
4616	Process not Found
1696	Process not Found
1944	Process not Found
3080	Process not Found
6992	Process not Found

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
8412	Process not Found
992	Process not Found
9392	Process not Found
8296	Process not Found
9792	Process not Found
4556	icacls.exe
8072	Process not Found
9128	Process not Found
8600	Process not Found
6800	Process not Found
2648	Process not Found
7504	Process not Found
8504	Process not Found
1036	takeown.exe
8644	Process not Found
1652	Process not Found
9860	Process not Found
6024	Process not Found
8616	Process not Found
3716	Process not Found
7256	takeown.exe
1108	Process not Found
8592	Process not Found
2700	Process not Found
8880	Process not Found
3100	Process not Found
6328	icacls.exe
5856	Process not Found
9128	Process not Found
9100	Process not Found
9404	Process not Found
5744	Process not Found
4360	icacls.exe
7284	takeown.exe
3056	Process not Found
2536	Process not Found
7564	Process not Found
9208	Process not Found
5008	Process not Found
7416	icacls.exe
8040	icacls.exe
9212	Process not Found
6356	takeown.exe
4896	Process not Found
3208	Process not Found
6468	Process not Found
5932	Process not Found
6264	Process not Found
6448	Process not Found
6668	Process not Found
10148	Process not Found
2876	Process not Found
7068	Process not Found
5412	Process not Found
8504	Process not Found
6972	takeown.exe
7136	takeown.exe
8844	Process not Found
2676	Process not Found
1892	Process not Found
3520	Process not Found
10200	Process not Found
9816	Process not Found
6520	icacls.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
3116	WScript.exe
6432	WScript.exe
7776	Process not Found
8796	Process not Found
2976	Process not Found
4648	Process not Found
8204	Process not Found
6640	WScript.exe
2600	WScript.exe
7056	WScript.exe
7192	WScript.exe
8588	Process not Found
3412	WScript.exe
5240	WScript.exe
5288	Process not Found
6304	WScript.exe
7276	WScript.exe
4088	WScript.exe
9508	Process not Found
5808	WScript.exe
6248	WScript.exe
7264	Process not Found
3436	WScript.exe
4732	WScript.exe
5364	WScript.exe
2924	WScript.exe
5908	WScript.exe
6884	WScript.exe
8952	Process not Found
3328	Process not Found
3948	WScript.exe
3344	WScript.exe
5200	Process not Found
8924	Process not Found
5464	WScript.exe
976	WScript.exe
8992	Process not Found
7148	WScript.exe
7856	WScript.exe
3532	Process not Found
7772	Process not Found
980	WScript.exe
6096	WScript.exe
1952	WScript.exe
8764	Process not Found
5184	Process not Found
1720	WScript.exe
6888	Process not Found
8084	Process not Found
2884	Process not Found
7272	Process not Found
8160	WScript.exe
2900	WScript.exe
5868	WScript.exe
6768	WScript.exe
8020	WScript.exe
6604	Process not Found
8388	Process not Found
4680	WScript.exe
4468	WScript.exe
6376	WScript.exe
7496	WScript.exe
8308	Process not Found
8488	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5712	msedge.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3148	msedge.exe
7324	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	WScript.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4140	3116	WScript.exe	89
PID 3116 wrote to memory of 1552	3116	WScript.exe	90

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
1⤵
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3116
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
  2⤵
  - UAC bypass
  - Disables RegEdit via registry modification
  - Checks whether UAC is enabled
  - System policy modification
  PID:4140
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
    3⤵
    PID:5588
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:980
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5808
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        8⤵
        
        PID:4764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        9⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        10⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        11⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        12⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3412
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        13⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        14⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        15⤵
        
        PID:4564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        16⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5240
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        17⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        18⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        19⤵
        
        PID:2520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        20⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        21⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        22⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        23⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        24⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        25⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        26⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        27⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        28⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        29⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        30⤵
        
        PID:5812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        31⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        32⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        33⤵
        
        PID:6944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        34⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        35⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        36⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        37⤵
        
        PID:2300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        38⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7496
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        39⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7148
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        40⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        41⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        42⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7276
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        43⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4088
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        44⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        45⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        46⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
        47⤵
        
        PID:3864
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        47⤵
        
        PID:1232
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        46⤵
        
        PID:6536
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        46⤵
        
        PID:8568
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        45⤵
        
        PID:7344
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        45⤵
        
        PID:7900
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        45⤵
        
        PID:4960
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        44⤵
        
        PID:6280
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        44⤵
        Modifies file permissions
        
        PID:7416
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        44⤵
        
        PID:7948
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        43⤵
        
        PID:6168
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        43⤵
        
        PID:7584
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        43⤵
        
        PID:7680
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        43⤵
        
        PID:4820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        42⤵
        
        PID:8076
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        42⤵
        
        PID:5020
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        42⤵
        
        PID:7984
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        42⤵
        
        PID:5796
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        42⤵
        
        PID:7988
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        41⤵
        
        PID:8176
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:6724
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        41⤵
        
        PID:5648
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:7572
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        41⤵
        
        PID:6196
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:6224
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        40⤵
        
        PID:8104
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:7984
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        40⤵
        
        PID:1560
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:7216
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        40⤵
        
        PID:7844
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:7552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        40⤵
        
        PID:7860
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        39⤵
        
        PID:1724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:8176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        39⤵
        
        PID:7304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:8104
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        39⤵
        
        PID:6816
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:8080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        39⤵
        
        PID:4780
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:6328
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        38⤵
        
        PID:7568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:7680
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        38⤵
        
        PID:7392
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:7924
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        38⤵
        
        PID:5852
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:3700
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        38⤵
        
        PID:1560
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:7352
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        38⤵
        
        PID:7808
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        37⤵
        
        PID:4436
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:7340
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        37⤵
        
        PID:8188
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:5880
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        37⤵
        
        PID:5784
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:4608
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        37⤵
        
        PID:7732
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:7092
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        37⤵
        
        PID:5104
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:8672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        36⤵
        
        PID:3252
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:7984
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        36⤵
        
        PID:5404
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:2552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        36⤵
        
        PID:8080
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:7936
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        36⤵
        
        PID:5800
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:8008
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        36⤵
        
        PID:6852
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:7580
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        36⤵
        
        PID:6356
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        35⤵
        
        PID:6504
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:2252
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        35⤵
        
        PID:7988
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:8068
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        35⤵
        
        PID:7320
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:5124
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        35⤵
        
        PID:7892
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:7288
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        35⤵
        
        PID:7320
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:7176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        35⤵
        
        PID:3120
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:8088
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        34⤵
        
        PID:6792
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:4300
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        34⤵
        
        PID:6844
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:7004
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        34⤵
        
        PID:4740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:6396
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        34⤵
        
        PID:7036
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:6480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        34⤵
        
        PID:6964
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:6092
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        34⤵
        
        PID:4236
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        34⤵
        Possible privilege escalation attempt
        
        PID:7608
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        33⤵
        
        PID:2516
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:4272
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        33⤵
        
        PID:4452
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:7556
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        33⤵
        
        PID:3464
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:6600
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        33⤵
        
        PID:7392
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:7816
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        33⤵
        
        PID:7988
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:5124
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        33⤵
        
        PID:7596
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:6472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        33⤵
        
        PID:3424
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        32⤵
        
        PID:5796
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:1216
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        32⤵
        
        PID:6876
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:3216
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        32⤵
        
        PID:6512
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:7776
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        32⤵
        
        PID:7360
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:4820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        32⤵
        
        PID:7084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:5388
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        32⤵
        
        PID:1204
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:7696
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        32⤵
        
        PID:8004
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:2532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        31⤵
        
        PID:2420
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:6588
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        31⤵
        
        PID:6736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:5320
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        31⤵
        
        PID:7080
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:2472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        31⤵
        
        PID:7812
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:3272
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        31⤵
        
        PID:7084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:3780
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        31⤵
        
        PID:7020
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        31⤵
        Possible privilege escalation attempt
        
        PID:2492
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        31⤵
        
        PID:6660
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:3672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        31⤵
        
        PID:3740
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        30⤵
        
        PID:3316
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:6264
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        30⤵
        
        PID:4768
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:5592
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        30⤵
        
        PID:5636
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:6384
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        30⤵
        
        PID:6208
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:6828
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        30⤵
        
        PID:7516
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:6292
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        30⤵
        
        PID:6684
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:7976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        30⤵
        
        PID:4108
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:7976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        30⤵
        
        PID:6736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:4780
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        29⤵
        
        PID:1348
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:5408
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        29⤵
        
        PID:6716
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:6204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        29⤵
        
        PID:1464
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:6660
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        29⤵
        
        PID:7392
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:5200
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        29⤵
        
        PID:6660
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:7464
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        29⤵
        
        PID:6660
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:7928
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        29⤵
        
        PID:5412
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:2724
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        29⤵
        
        PID:6172
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:3548
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        29⤵
        
        PID:8796
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        28⤵
        
        PID:4368
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:6312
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        28⤵
        
        PID:6672
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:4368
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        28⤵
        
        PID:1880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:4584
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        28⤵
        
        PID:1076
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:7592
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        28⤵
        
        PID:5648
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:7204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        28⤵
        
        PID:7428
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:7576
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        28⤵
        
        PID:5628
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:2472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        28⤵
        
        PID:2508
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:3532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        28⤵
        
        PID:7732
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        27⤵
        
        PID:6680
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:5992
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        27⤵
        
        PID:3152
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6404
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        27⤵
        
        PID:6232
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:7052
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        27⤵
        
        PID:2328
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:1652
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        27⤵
        
        PID:4336
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:4580
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        27⤵
        
        PID:7428
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:8064
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        27⤵
        
        PID:4656
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:8168
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        27⤵
        
        PID:7340
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        27⤵
        Modifies file permissions
        
        PID:8040
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        27⤵
        
        PID:6384
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:2552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        26⤵
        
        PID:6688
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6896
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        26⤵
        
        PID:5736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        26⤵
        Modifies file permissions
        
        PID:7136
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6692
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        26⤵
        
        PID:1012
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:4808
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        26⤵
        
        PID:4820
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:7772
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        26⤵
        Modifies file permissions
        
        PID:7284
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        26⤵
        Possible privilege escalation attempt
        
        PID:2976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        26⤵
        
        PID:8060
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:7596
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        26⤵
        
        PID:8016
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:7388
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        26⤵
        
        PID:7708
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:2200
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        26⤵
        
        PID:7552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        25⤵
        
        PID:4368
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6984
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        25⤵
        
        PID:6528
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6400
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        25⤵
        
        PID:4336
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:3980
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        25⤵
        
        PID:5720
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6848
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        25⤵
        
        PID:6736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:7680
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        25⤵
        
        PID:1256
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:7688
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        25⤵
        
        PID:6172
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:3364
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        25⤵
        
        PID:5912
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        25⤵
        Possible privilege escalation attempt
        
        PID:6684
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        25⤵
        
        PID:7344
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:7552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        25⤵
        
        PID:7572
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6292
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        24⤵
        
        PID:5152
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:3860
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        24⤵
        
        PID:3168
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:2000
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        24⤵
        
        PID:6692
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:4320
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        24⤵
        
        PID:2152
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:908
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        24⤵
        
        PID:6140
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        24⤵
        Modifies file permissions
        
        PID:6520
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        24⤵
        Modifies file permissions
        
        PID:7256
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:7456
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        24⤵
        
        PID:5912
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:6608
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        24⤵
        
        PID:3056
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:7756
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        24⤵
        
        PID:7756
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:7836
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        24⤵
        
        PID:6608
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:2848
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        24⤵
        
        PID:2208
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        23⤵
        
        PID:6032
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:5904
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        23⤵
        
        PID:120
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:6956
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        23⤵
        
        PID:6456
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:4808
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        23⤵
        
        PID:6220
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:4148
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        23⤵
        
        PID:5292
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:2492
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        23⤵
        Possible privilege escalation attempt
        
        PID:6680
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:2008
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        23⤵
        
        PID:7216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        23⤵
        Possible privilege escalation attempt
        
        PID:4180
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        23⤵
        
        PID:8040
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:6232
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        23⤵
        
        PID:1288
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:8064
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        23⤵
        
        PID:6340
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:2840
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        23⤵
        
        PID:7848
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:6512
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        22⤵
        
        PID:1888
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:3356
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        22⤵
        
        PID:4400
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:2480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        22⤵
        
        PID:3480
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:4540
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        22⤵
        
        PID:2472
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6500
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        22⤵
        
        PID:6220
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6756
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        22⤵
        
        PID:6388
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        22⤵
        Modifies file permissions
        
        PID:6328
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        22⤵
        
        PID:6180
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:7900
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        22⤵
        
        PID:3248
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:7636
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        22⤵
        
        PID:7440
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:7440
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        22⤵
        
        PID:7068
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:7452
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        22⤵
        
        PID:2164
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:7600
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        22⤵
        
        PID:8820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        21⤵
        
        PID:4328
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:5964
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        21⤵
        
        PID:944
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:2764
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        21⤵
        
        PID:4708
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:2420
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        21⤵
        Possible privilege escalation attempt
        
        PID:4340
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:6164
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        21⤵
        
        PID:4620
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:7044
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        21⤵
        
        PID:6460
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:6556
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        21⤵
        
        PID:2116
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:7548
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        21⤵
        
        PID:7692
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:6676
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        21⤵
        
        PID:6184
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:5404
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        21⤵
        
        PID:8044
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:3740
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        21⤵
        
        PID:7952
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:4264
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        21⤵
        
        PID:6980
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        20⤵
        
        PID:2584
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:5576
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        20⤵
        
        PID:6088
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        20⤵
        Possible privilege escalation attempt
        
        PID:1756
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        20⤵
        
        PID:4876
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:6424
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        20⤵
        
        PID:7124
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:5292
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        20⤵
        
        PID:6592
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:6316
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        20⤵
        
        PID:6508
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:3480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        20⤵
        
        PID:6604
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:6472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        20⤵
        
        PID:6576
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:6708
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        20⤵
        
        PID:7812
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:7812
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        20⤵
        
        PID:6592
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:7556
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        20⤵
        
        PID:7580
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:3056
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        20⤵
        
        PID:5720
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:7444
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        19⤵
        
        PID:3384
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:2152
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        19⤵
        
        PID:4580
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:5812
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        19⤵
        
        PID:3312
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:4584
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        19⤵
        
        PID:4360
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:5736
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        19⤵
        
        PID:6940
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:4520
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        19⤵
        
        PID:6736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:3016
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        19⤵
        
        PID:6964
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:5020
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        19⤵
        
        PID:2000
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:8028
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        19⤵
        
        PID:7596
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:7872
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        19⤵
        
        PID:7176
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:4928
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        19⤵
        
        PID:4148
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:7760
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        19⤵
        
        PID:6264
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:6184
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        19⤵
        
        PID:5880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:8540
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        18⤵
        
        PID:5724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:5448
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        18⤵
        
        PID:828
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:1992
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        18⤵
        Possible privilege escalation attempt
        
        PID:5736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:2208
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        18⤵
        
        PID:2472
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:4132
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        18⤵
        
        PID:6208
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:7080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        18⤵
        
        PID:120
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:6812
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        18⤵
        
        PID:6340
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:7100
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        18⤵
        
        PID:4876
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:7632
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        18⤵
        
        PID:7080
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:3364
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        18⤵
        
        PID:1780
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:8052
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        18⤵
        
        PID:7516
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:4712
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        18⤵
        
        PID:7760
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:6984
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        18⤵
        
        PID:6776
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:4412
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        17⤵
        
        PID:5984
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:5096
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        17⤵
        
        PID:800
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:3056
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        17⤵
        
        PID:5956
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:5912
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        17⤵
        
        PID:3392
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:256
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        17⤵
        
        PID:7004
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:2188
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        17⤵
        
        PID:240
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:6676
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        17⤵
        
        PID:6656
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:2040
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        17⤵
        
        PID:6892
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:5320
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        17⤵
        
        PID:7336
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:5736
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        17⤵
        
        PID:6632
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:7972
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        17⤵
        
        PID:2976
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:6892
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        17⤵
        
        PID:5912
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:7440
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        17⤵
        
        PID:2764
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:8316
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        16⤵
        
        PID:2812
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:5552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        16⤵
        
        PID:624
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:5912
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        16⤵
        
        PID:4568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:4784
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        16⤵
        
        PID:244
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:2000
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        16⤵
        
        PID:5180
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        16⤵
        
        PID:3632
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:3288
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        16⤵
        
        PID:7080
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6388
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        16⤵
        
        PID:4496
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:4912
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        16⤵
        
        PID:6708
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:7728
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        16⤵
        
        PID:7280
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:8060
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        16⤵
        
        PID:5480
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6328
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        16⤵
        
        PID:6656
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:7720
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        16⤵
        
        PID:5824
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6424
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        16⤵
        
        PID:4396
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:8272
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        15⤵
        
        PID:3056
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:5880
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        15⤵
        
        PID:4516
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:832
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        15⤵
        
        PID:2240
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:4352
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        15⤵
        
        PID:5984
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:940
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        15⤵
        
        PID:5800
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:5152
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        15⤵
        
        PID:5680
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:6780
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        15⤵
        
        PID:7084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:2492
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        15⤵
        
        PID:6396
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:6608
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        15⤵
        
        PID:6820
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:1740
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        15⤵
        
        PID:6288
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:7828
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        15⤵
        
        PID:3740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:7644
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        15⤵
        
        PID:6908
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:7680
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        15⤵
        
        PID:4624
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:7284
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        15⤵
        
        PID:7036
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:1236
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
        15⤵
        
        PID:8516
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        14⤵
        
        PID:1544
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:3452
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        14⤵
        
        PID:2928
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:3516
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        14⤵
        
        PID:3288
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:2828
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        14⤵
        
        PID:2492
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:4372
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        14⤵
        
        PID:4320
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:5584
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        14⤵
        
        PID:5380
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:5992
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        14⤵
        Modifies file permissions
        
        PID:6972
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:1344
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        14⤵
        
        PID:6848
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:7076
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        14⤵
        
        PID:6940
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:6176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        14⤵
        
        PID:5664
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:7864
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        14⤵
        
        PID:7868
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:7908
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        14⤵
        
        PID:8176
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:5648
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        14⤵
        
        PID:7100
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:3080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        14⤵
        
        PID:7808
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:2436
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
        14⤵
        
        PID:6676
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:7288
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        13⤵
        
        PID:4712
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:4176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        13⤵
        
        PID:4504
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:4336
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        13⤵
        
        PID:2816
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:1680
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        13⤵
        
        PID:2552
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:3220
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        13⤵
        
        PID:4808
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:5724
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        13⤵
        
        PID:4768
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:6672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        13⤵
        
        PID:3324
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:5480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        13⤵
        Possible privilege escalation attempt
        
        PID:1072
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:6164
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        13⤵
        
        PID:1556
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:6364
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        13⤵
        
        PID:6788
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:6676
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        13⤵
        
        PID:6952
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:5636
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        13⤵
        
        PID:7208
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:7144
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        13⤵
        
        PID:7632
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:7084
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        13⤵
        
        PID:7084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:7020
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
        13⤵
        
        PID:8072
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:6280
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        12⤵
        
        PID:1464
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:2428
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        12⤵
        
        PID:4496
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:5184
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        12⤵
        
        PID:3120
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:1204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        12⤵
        
        PID:6032
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:4776
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        12⤵
        
        PID:5364
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:5672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        12⤵
        
        PID:1088
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:4592
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        12⤵
        
        PID:6968
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:2164
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        12⤵
        
        PID:3216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:4608
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        12⤵
        
        PID:6548
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:1016
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        12⤵
        
        PID:1076
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:5756
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        12⤵
        
        PID:7288
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:7696
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        12⤵
        
        PID:7864
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:4772
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        12⤵
        
        PID:8180
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:7500
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        12⤵
        
        PID:5804
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:6844
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
        12⤵
        
        PID:7564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:6540
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveClear.vsdm >nul 2>&1
        12⤵
        
        PID:7632
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        11⤵
        
        PID:6000
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:1016
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        11⤵
        
        PID:3512
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:2476
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        11⤵
        
        PID:1212
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:2784
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        11⤵
        
        PID:3808
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:932
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        11⤵
        
        PID:6096
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:1500
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        11⤵
        
        PID:4352
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:5648
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        11⤵
        
        PID:4392
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:5288
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        11⤵
        
        PID:6980
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:6812
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        11⤵
        
        PID:2880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:3464
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        11⤵
        
        PID:6336
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:6964
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        11⤵
        
        PID:6588
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:7828
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        11⤵
        
        PID:6480
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:4832
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        11⤵
        
        PID:7236
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:6708
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        11⤵
        
        PID:4452
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:6652
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
        11⤵
        
        PID:5736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:6888
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveClear.vsdm >nul 2>&1
        11⤵
        
        PID:7904
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveClear.vsdm" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:8452
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        10⤵
        
        PID:1440
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        10⤵
        Possible privilege escalation attempt
        
        PID:3712
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        10⤵
        
        PID:1548
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:4608
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        10⤵
        
        PID:4768
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:2684
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        10⤵
        
        PID:1352
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:1640
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        10⤵
        
        PID:4988
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        10⤵
        Possible privilege escalation attempt
        
        PID:5096
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        10⤵
        
        PID:260
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:5104
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        10⤵
        
        PID:1692
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:3536
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        10⤵
        
        PID:6880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:6148
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        10⤵
        
        PID:2936
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:3524
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        10⤵
        
        PID:5880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:4668
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        10⤵
        
        PID:3212
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:4556
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        10⤵
        
        PID:6540
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:6648
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        10⤵
        
        PID:1412
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:7384
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        10⤵
        
        PID:5668
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:1204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
        10⤵
        
        PID:6152
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:3364
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveClear.vsdm >nul 2>&1
        10⤵
        
        PID:5048
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveClear.vsdm" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:7752
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveStart.emf >nul 2>&1
        10⤵
        
        PID:8632
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        9⤵
        
        PID:5384
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:4188
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        9⤵
        
        PID:4088
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:3324
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        9⤵
        
        PID:4456
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:4828
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        9⤵
        
        PID:3468
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:3484
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        9⤵
        
        PID:936
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:4276
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        9⤵
        
        PID:5900
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:3560
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        9⤵
        
        PID:4392
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:2044
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        9⤵
        
        PID:5408
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6200
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        9⤵
        
        PID:6364
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:5372
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        9⤵
        
        PID:6484
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6460
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        9⤵
        
        PID:6780
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6916
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        9⤵
        
        PID:3048
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        9⤵
        
        PID:6564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6636
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        9⤵
        
        PID:8092
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6648
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
        9⤵
        
        PID:1012
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:3828
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveClear.vsdm >nul 2>&1
        9⤵
        Modifies file permissions
        
        PID:6356
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveClear.vsdm" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:7036
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveStart.emf >nul 2>&1
        9⤵
        
        PID:6484
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveStart.emf" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:2884
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResolveRepair.htm >nul 2>&1
        9⤵
        
        PID:6984
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        8⤵
        Possible privilege escalation attempt
        
        PID:6112
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:2428
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        8⤵
        
        PID:3012
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:1260
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        8⤵
        
        PID:4476
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:5672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        8⤵
        
        PID:3188
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:1948
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        8⤵
        
        PID:5576
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:3076
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        8⤵
        
        PID:2928
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4844
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        8⤵
        
        PID:5672
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:5288
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        8⤵
        
        PID:4772
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:1632
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        8⤵
        
        PID:2880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:2492
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        8⤵
        
        PID:7120
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4548
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        8⤵
        
        PID:6852
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6736
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        8⤵
        
        PID:6268
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:908
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        8⤵
        
        PID:1256
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:7884
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        8⤵
        
        PID:4088
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6452
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
        8⤵
        
        PID:1788
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:7368
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveClear.vsdm >nul 2>&1
        8⤵
        
        PID:2880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveClear.vsdm" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6032
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveStart.emf >nul 2>&1
        8⤵
        
        PID:1724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveStart.emf" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6420
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResolveRepair.htm >nul 2>&1
        8⤵
        
        PID:4740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResolveRepair.htm" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:2848
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        7⤵
        
        PID:3676
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:1716
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        7⤵
        
        PID:4336
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:2932
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        7⤵
        
        PID:2068
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:4196
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        7⤵
        
        PID:2836
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:4144
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        7⤵
        
        PID:2324
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:3096
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        7⤵
        
        PID:1952
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:1236
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        7⤵
        
        PID:2328
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:3860
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        7⤵
        
        PID:5052
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:2860
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        7⤵
        
        PID:4456
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6904
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        7⤵
        
        PID:6828
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6608
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        7⤵
        
        PID:6792
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:936
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        7⤵
        
        PID:1256
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:1016
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        7⤵
        
        PID:6672
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6340
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        7⤵
        
        PID:7416
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:7704
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
        7⤵
        
        PID:7440
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:7920
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveClear.vsdm >nul 2>&1
        7⤵
        
        PID:7860
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveClear.vsdm" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6280
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveStart.emf >nul 2>&1
        7⤵
        
        PID:4780
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveStart.emf" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResolveRepair.htm >nul 2>&1
        7⤵
        
        PID:8056
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        6⤵
        
        PID:5668
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:1464
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        6⤵
        
        PID:5096
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:5416
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        6⤵
        
        PID:3500
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:2792
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        6⤵
        
        PID:4776
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:4876
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        6⤵
        
        PID:2384
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:1128
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        6⤵
        
        PID:1412
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:3324
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        6⤵
        
        PID:3216
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:5320
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        6⤵
        
        PID:5048
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:5796
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        6⤵
        
        PID:3120
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:5184
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        6⤵
        
        PID:7064
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:7096
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        6⤵
        
        PID:1352
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:7160
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        6⤵
        
        PID:6620
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:1172
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        6⤵
        
        PID:2788
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:6572
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        6⤵
        
        PID:4768
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        6⤵
        Possible privilege escalation attempt
        
        PID:4580
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
        6⤵
        
        PID:6036
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:7492
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveClear.vsdm >nul 2>&1
        6⤵
        
        PID:7704
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveClear.vsdm" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:7864
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveStart.emf >nul 2>&1
        6⤵
        
        PID:7388
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveStart.emf" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:6208
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResolveRepair.htm >nul 2>&1
        6⤵
        
        PID:6976
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResolveRepair.htm" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:2236
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\SaveHide.edrwx >nul 2>&1
        6⤵
        
        PID:3252
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\SaveHide.edrwx" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:8712
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        5⤵
        
        PID:4880
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:2364
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        5⤵
        
        PID:4956
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:1392
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        5⤵
        
        PID:828
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:1624
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        5⤵
        
        PID:5900
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:2324
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
        5⤵
        
        PID:1888
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:1268
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        5⤵
        
        PID:4084
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4448
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
        5⤵
        
        PID:5020
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:5636
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        5⤵
        
        PID:2424
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4260
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
        5⤵
        
        PID:1216
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:384
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
        5⤵
        
        PID:932
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:2304
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
        5⤵
        
        PID:260
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:2328
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
        5⤵
        
        PID:6524
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6988
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
        5⤵
        
        PID:4304
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6492
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
        5⤵
        
        PID:1632
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4928
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
        5⤵
        
        PID:7048
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:7852
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveClear.vsdm >nul 2>&1
        5⤵
        
        PID:8008
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveClear.vsdm" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:3056
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveStart.emf >nul 2>&1
        5⤵
        
        PID:7052
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveStart.emf" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6192
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResolveRepair.htm >nul 2>&1
        5⤵
        
        PID:7104
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ResolveRepair.htm" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:7928
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\SaveHide.edrwx >nul 2>&1
        5⤵
        
        PID:7268
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\SaveHide.edrwx" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:1724
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\StopSet.wma >nul 2>&1
        5⤵
        
        PID:6256
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\StopSet.wma" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:8208
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
      4⤵
      PID:4172
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4228
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
      4⤵
      PID:6044
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
      4⤵
      PID:5752
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
      4⤵
      PID:4148
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4732
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
      4⤵
      PID:2880
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
      4⤵
      PID:2908
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
      4⤵
      PID:6116
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
      4⤵
      Possible privilege escalation attempt
      PID:1524
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f >nul 2>&1
      4⤵
      PID:1216
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
      4⤵
      PID:256
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
      4⤵
      PID:2000
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
      4⤵
      PID:3500
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
      4⤵
      PID:5412
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4132
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
      4⤵
      PID:4700
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4740
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
      4⤵
      Modifies file permissions
      PID:1036
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4260
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
      4⤵
      PID:6284
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6260
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
      4⤵
      Possible privilege escalation attempt
      PID:7064
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6972
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
      4⤵
      PID:6844
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6988
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
      4⤵
      PID:1348
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
      4⤵
      PID:1680
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
      4⤵
      PID:6876
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
      4⤵
      PID:7016
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveClear.vsdm >nul 2>&1
      4⤵
      PID:7992
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveClear.vsdm" /grant Administrators:F >nul 2>&1
      4⤵
      PID:8172
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveStart.emf >nul 2>&1
      4⤵
      PID:120
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveStart.emf" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6952
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResolveRepair.htm >nul 2>&1
      4⤵
      PID:4496
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ResolveRepair.htm" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6952
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\SaveHide.edrwx >nul 2>&1
      4⤵
      PID:6180
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\SaveHide.edrwx" /grant Administrators:F >nul 2>&1
      4⤵
      PID:2472
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\StopSet.wma >nul 2>&1
      4⤵
      PID:7816
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
    3⤵
    PID:944
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
    3⤵
    PID:3120
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
    3⤵
    PID:4828
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6092
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
    3⤵
    PID:5660
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
    3⤵
    PID:976
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
    3⤵
    PID:3220
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5644
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
    3⤵
    PID:4852
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
    3⤵
    PID:244
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f >nul 2>&1
    3⤵
    PID:2640
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
    3⤵
    PID:1472
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
    3⤵
    PID:4656
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
    3⤵
    PID:2828
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
    3⤵
    PID:5592
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
    3⤵
    PID:2392
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
    3⤵
    PID:3220
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4772
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
    3⤵
    PID:3716
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5800
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
    3⤵
    PID:3188
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
    3⤵
    PID:2984
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
    3⤵
    PID:6368
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
    3⤵
    PID:3240
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
    3⤵
    PID:6992
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6328
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
    3⤵
    PID:1716
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6900
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
    3⤵
    PID:6784
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
    3⤵
    PID:1392
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveClear.vsdm >nul 2>&1
    3⤵
    PID:4656
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveClear.vsdm" /grant Administrators:F >nul 2>&1
    3⤵
    PID:8044
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveStart.emf >nul 2>&1
    3⤵
    PID:7856
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveStart.emf" /grant Administrators:F >nul 2>&1
    3⤵
    PID:7868
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResolveRepair.htm >nul 2>&1
    3⤵
    PID:7480
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ResolveRepair.htm" /grant Administrators:F >nul 2>&1
    3⤵
    PID:7448
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\SaveHide.edrwx >nul 2>&1
    3⤵
    PID:7264
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\SaveHide.edrwx" /grant Administrators:F >nul 2>&1
    3⤵
    PID:3148
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\StopSet.wma >nul 2>&1
    3⤵
    PID:6988
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\StopSet.wma" /grant Administrators:F >nul 2>&1
    3⤵
    PID:7932
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\UnblockPing.lnk >nul 2>&1
    3⤵
    PID:3248
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\UnblockPing.lnk" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6604
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
  2⤵
  PID:1552
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
  2⤵
  PID:1432
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
  2⤵
  PID:4868
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
  2⤵
  PID:2568
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
  2⤵
  PID:816
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
  2⤵
  PID:1640
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
  2⤵
  PID:5480
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5240
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini >nul 2>&1
  2⤵
  PID:5308
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4988
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f >nul 2>&1
  2⤵
  PID:4156
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
  2⤵
  PID:2240
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ComparePush.snd >nul 2>&1
  2⤵
  PID:1652
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ComparePush.snd" /grant Administrators:F >nul 2>&1
  2⤵
  PID:1352
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
  2⤵
  PID:4644
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
  2⤵
  PID:1360
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\DisconnectUnpublish.rtf >nul 2>&1
  2⤵
  PID:5900
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\DisconnectUnpublish.rtf" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6088
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\GrantStart.xlsb >nul 2>&1
  2⤵
  PID:940
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\GrantStart.xlsb" /grant Administrators:F >nul 2>&1
  2⤵
  PID:560
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\LimitFind.htm >nul 2>&1
  2⤵
  PID:2904
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\LimitFind.htm" /grant Administrators:F >nul 2>&1
  2⤵
  PID:3012
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\MountSend.css >nul 2>&1
  2⤵
  PID:5388
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\MountSend.css" /grant Administrators:F >nul 2>&1
  2⤵
  - Modifies file permissions
  PID:4360
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\OpenBlock.mpeg3 >nul 2>&1
  2⤵
  PID:6164
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\OpenBlock.mpeg3" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6176
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\OutRedo.AAC >nul 2>&1
  2⤵
  PID:1788
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\OutRedo.AAC" /grant Administrators:F >nul 2>&1
  2⤵
  - Modifies file permissions
  PID:4556
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\PublishRequest.mp3 >nul 2>&1
  2⤵
  PID:6444
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\PublishRequest.mp3" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4620
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveClear.vsdm >nul 2>&1
  2⤵
  PID:2928
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveClear.vsdm" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6576
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\RemoveStart.emf >nul 2>&1
  2⤵
  PID:7200
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\RemoveStart.emf" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6876
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ResolveRepair.htm >nul 2>&1
  2⤵
  PID:4780
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ResolveRepair.htm" /grant Administrators:F >nul 2>&1
  2⤵
  PID:7808
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\SaveHide.edrwx >nul 2>&1
  2⤵
  PID:7360
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\SaveHide.edrwx" /grant Administrators:F >nul 2>&1
  2⤵
  PID:3512
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\StopSet.wma >nul 2>&1
  2⤵
  PID:7932
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\StopSet.wma" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6644
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\UnblockPing.lnk >nul 2>&1
  2⤵
  PID:6808
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\UnblockPing.lnk" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6184
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\UseEnter.dib >nul 2>&1
  2⤵
  PID:7204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\TestPing.xht
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffac563c188,0x7ffac563c194,0x7ffac563c1a0
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,13578731115331603735,4798800375795891445,524288 --field-trial-handle=2152,i,9924480220162237049,2912364328097217589,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,795173885865331181,8327569123142807203,262144 --field-trial-handle=2152,i,9924480220162237049,2912364328097217589,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,4853141907752786947,7524296769765898600,524288 --field-trial-handle=2152,i,9924480220162237049,2912364328097217589,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,1184399395080545636,14467406088897361695,2097152 --field-trial-handle=2152,i,9924480220162237049,2912364328097217589,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,16555640897879274323,3490963551857975836,2097152 --field-trial-handle=2152,i,9924480220162237049,2912364328097217589,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,10298936097248702487,2833556931764294458,2097152 --field-trial-handle=2152,i,9924480220162237049,2912364328097217589,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:9
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,13794205392580288384,16179632459641203743,2097152 --field-trial-handle=2152,i,9924480220162237049,2912364328097217589,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,6252422319621359628,16834194266320364358,524288 --field-trial-handle=2152,i,9924480220162237049,2912364328097217589,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:6512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,7165222870457082231,12404375675340865526,524288 --field-trial-handle=2152,i,9924480220162237049,2912364328097217589,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:6776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,10652447707884909517,14102980101072060621,524288 --field-trial-handle=2152,i,9924480220162237049,2912364328097217589,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:6448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffac563c188,0x7ffac563c194,0x7ffac563c1a0
    3⤵
    PID:6220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1412,i,912665526866871182,8431149244459196427,262144 --field-trial-handle=2600,i,7512064688527659161,3069549317156530810,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
    3⤵
    PID:7308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,1905965647365639770,17901702512001320651,524288 --field-trial-handle=2600,i,7512064688527659161,3069549317156530810,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:11
    3⤵
    - System Time Discovery
    PID:7324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,17518457596561256747,4829051131921249225,524288 --field-trial-handle=2600,i,7512064688527659161,3069549317156530810,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:13
    3⤵
    PID:7408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,13852823746979330840,2995932487956092616,524288 --field-trial-handle=2600,i,7512064688527659161,3069549317156530810,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
    3⤵
    PID:6724
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,4626563200562885041,3907066504904597091,524288 --field-trial-handle=2600,i,7512064688527659161,3069549317156530810,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,4626563200562885041,3907066504904597091,524288 --field-trial-handle=2600,i,7512064688527659161,3069549317156530810,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
    3⤵
    PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 315c4810e4623d00435ee4ef0fa1edc4c7a37fc4e088b1aa4bc292ede79e3cda
MD5 c2deabe318b73c09e830cb0f500bdd42
SHA1 6173111f7b0be5a20ba68a1cf793040f18f6b710
SHA512 df750081ea28e44e98a10e233f761f130ddb7715d5b6104c53ca031c72b823e4835d1a6867bab8d9c60335a19d0fed6975caf2cfbc8d5e73976d9a1d4233dabb
TLSH
T1A3D023303818F7C8C551217288B03300722000B278B103081020AC1CCE300C337DFECF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c891eb56024d57bc6705824cbf5ce00e844954e5c696f452c6a2e0461c1dc646
MD5 c90ed78e180c296c5665099469a6cc8b
SHA1 32373784419c610f1ec116cda177fd3b71c21484
SHA512 10eb279e4134425524e6425b958ee42f14dfd39f396965f90ef87e1c9c9cc634bddb4cc4aa434e5b543a1bf3660d69fef23f6097d08e59433357c7173fe63165
SSDEEP 192:+q7lO1esA91kdkvwN4kGgB91xWRqJ77PRI0kAJxM0D3+2LOPyoq:+qxh0d+kGeWY+AJ9D3Xp
TLSH
T1ED13D7FEBA4F8CC2DADB11BD68631FF69334C0F4D0D151A3927932829822741BE9E555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 d998a7d9da92d4aaa9d06fa494fc0342b4dd97d955a7609aa77cdf7628b5316f
MD5 35439a212f4e947350154def0613ba2d
SHA1 e9b4823141e3075b9a43d155eccad0fc9001ea13
SHA512 d7668a090764cb3757cce210d7493477cd3040585642fa104f5b14bdfea6164df0e57b2fc2d5bf4c910a7040ef68f413560355e7aa11de632fd2e1ee434507d9
SSDEEP 768:WJogNobCL/cltL/26naivw09HbwfKhW6NQz7MSQRdTbWQpi/pK8baVKmN:WyOL/cjL/2v0qShWiQYy
TLSH
T15C442FF71951A05BCBA852F9D6033E7ED1B7455D3CD1F8E8D5784C812829B32B2BCA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 23d136ca439a194d956a4b7bf661851c8b5eabf27bd4aa4e5c6ad822022b0142
MD5 548b50ebb4c79c7b111db9c223437732
SHA1 ee040b8809fd298a4bc4ae75132a928c64490c95
SHA512 b4224b81e0bf111df1624ab33e41be4f27e01d940b76b77b8851ce5002c82875d3f16e2f790e42a407aaa445c88cf0348ea17bdbeaa9639cf8dd1a1d7fcd64af
SSDEEP 24576:1Hk0E5BGb2RGrrl9G7yDA9pvUJqEcZ6Qr:1E0Bb2q6mWpvU5M
TLSH
T157168DEDC97858C3CD639A30B4F0E9877C7413C3F995C1D68898C584026B7C5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c5823584fa2813dea1e8d423203ee2a54aeea8b3bd124c78d234a6b5752b955e
MD5 97588482eceebd00933a6770ba3506da
SHA1 326059a1c5aa75b34031eaf4a0464520c3d49fbe
SHA512 68d49999cb2cf7cc9b98f1480647902c8961841dbd4a2953be77a229cb9538f5e90f80529674abd9b56d52382b43720f42f554d354b51ac960786d0da0b2b4f1
TLSH
T1A85112F7E3EFCED1CF5544BF60E2E5D53278895A47032AB1827650B8697271CA0C92D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59485a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59485a.TMP
Size 2KB
SHA256 fe8900e8ec5ec405ccf9b316ac716d33e4968ae262748b29d18852578d8687c6
MD5 ea667cb1c989b08760ebcbe58ab25dc1
SHA1 eca39e58618920b3f2eb103f4ae7ff8907fdfe65
SHA512 8f945cf074bb82944732b8b506dcc746f66946d57103dfd96447df4c01fc6b2a12678d0c4a4e3b0a15fd2b6afc7673b0ac58867978b4edda717a7774050e5995
TLSH
T19C512FF7E3EFCAD1CF5644BF60E2E5D43238895A47032AB1827650B8697271CB0C92D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 3b7c11c2218aa1762e8cd5624ecdd33d68a843ae4ea95aab04698e9d2546861c
MD5 994c556ce806d3f54825e4f8fe07e148
SHA1 826399773d5c38f67a409cacbf12fe5780e606c3
SHA512 62f3ba5de7eb2b692a6bb55f252f918c0490bd0fca9b1690c39edae062d2a0fa9dacc88bf37d374c9be3cc1a20077de8fc62bb2965f9172f7b7c0015019e4115
TLSH
T101E0D8D564C6C31F996034C29134674C81D23443D6856F431F4088C07B43502BF41B4E
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 4c437c74472a478e92487ec035988fd820bf6401f0169ae310492a430091466a
MD5 3b29e38dbf3b5361398bf597e1c7f76f
SHA1 f32e2085cf92b6908792d520d4c67db26fb614d7
SHA512 9a023bd2b63e5e86a99dc1da17688c1f7f01b3bd0f29884fcdd6891ee878ec40b602fdae374250ad9527505fa8e98db316fa063e28e614057a0c05856e95ac89
TLSH
T119E0CD9418CED52FD76479D7837C734C83D5744AF6C83F8237898850B60364ABB96B81
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 ead1e269a733b1419b51a1e7b3e538eb4cd0800db8b9c93e59d7995ac031580b
MD5 9e720f8c7e1800ffdfb1708834e59098
SHA1 9c3d51ffe5501449eaaf1d165074e21d9ca644f7
SHA512 2ba5e721a4b1e9ef4ffa60873222179e3deb9dcec077abc0f4b88956e06811e8f403d9c8c6d8de03086d7fc63af80c9817b4cb0b85fd81f116a26dc2953af455
SSDEEP 96:rEGptejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/5NbbEOVpZf24JkMfXSFR+CFqD:rELH+bF+UI3iWGVoWN3qL/3VVV63
TLSH
T11324000E5F342722CDBD913668E744A35C7DF03F8B5366DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 c8810d024cfd17bf999375d5b8ae8ee8c65527032835ea3ee023b9e6665bfcab
MD5 91f897f37a836ba547f3300577dcc761
SHA1 bd5722cc7855dbc1b68c0cfbcea42e07161e9753
SHA512 accd3ca3126c6df3cd80bc4d553eee6e926edc189751676e76eaf21d60ecb7cec1a1368a0d3038b7f5f55d56ab8bd69f1726ddc9b37cd02f2b3bce32957c90d7
SSDEEP 3:K9ln3lljq7A/mhWJFuQ30VkWUll/dwenqFtjE9SFcTpL0WWaV1vGrV9RUI1:K9G7/Vkx/d4FS99pLTB1eBv
TLSH
T12802805106519473ECD8973DA2D740DC1F727D0C4653E901C14CCC130E056DC434545F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 9e767cb06094959cf3df1c86818c15ed98f4611a526abdc0eec5bbe534937ed5
MD5 6c2d6f96011bf499bdf7dcccbfa02815
SHA1 613328edc1f02fe12587172a966cc8a829a42554
SHA512 8c58a3c5bcf02f60b0a3f9e4367d6492f3a1fad97b3e8c3faf4d2579ccec67c111c85d5876d8f1098c471a70c9d56ef62f1d0f434d694efa07e71b0385dc8fa0
TLSH
T1F2E026A154CEC36F6259308F82387B0CD3B03407E7A93FC26B84D850BA03149EB823C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 c2882ec55246293bf0da6f94778d51c9e5df5ca4a54d53c9d3143fdbed218728
MD5 a6538799f414a33918cd78591d55216b
SHA1 0c2494dd302a41909874f7f50f34f2aa80202599
SHA512 10d7956b3aa70922e05d90fc59f86f4fb0de90264bf84f06ad0adcb6275fbf56f3d692d52a92264e52a0220959e9afc90cd7400e95c779309e0cee0b0cc87afb
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7olwDlk:qDeMatha9RAJOk
TLSH
T144B22E0D1F307212C0F05B76EDC184672E7C111CD3732A8A9A1420F28E926AFB50A4A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 168374e222ea69edb026d58d4eb192c88aa32d0b202bdee6eafa146b8fba8625
MD5 e07fcaee94cbf9c94c699917b7de3aa7
SHA1 c3a2adf44b79467e6bcd8e9b45d53e21f03fb3db
SHA512 db16650362b9f6ea9da5abf9f49c3a860b285d491dd31fd85e221cb2501b4a1aa929a10f81196b09011343ad9863de226df4f3aec2c388bd0fb582ea15152216
TLSH
T16E41ACF3C3E4896E890156F4AB146E1BCE2D0915832C7D5AC9E4AF1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 89745d7118a7e4e963d857d2000e17b48891c329d9534d74ef19e2b80df98a74
MD5 0866efbebd39b51244fbfa2ac45c0518
SHA1 b6d0a183405f75466dd270f165084e8ce92538c1
SHA512 cfb12075bd6dec202deb97a0623c63cb1d8169277b58ce10b6580d081bb128d3caae8c96645b3da0edf6e83f84284e7788187873d3b59c3499071f24ba6717d8
TLSH
T15B41ACF3C3E4896E890156F4AB146E1BCE2D0915832C7D5AC9E4AF1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 6cd4105c46082a0795b7bf01fb06c1baa384e978ee1d566248f474c8b7cd53d0
MD5 e6dcbef3948cb430477867975d30e329
SHA1 a2fcef8c2d9ad0db64e80470d998b1b1c8fb60f3
SHA512 a412d31fd24e191b6eabdebdfcd932271b7ade19c508925f8d030e73c20dbb6f7e0e2742a0231942d0f9caf2aebd73bd7c757d61510128af3620c2e8d8b6116a
SSDEEP 48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSDPo0:eIEumQv8m1ccnvSoePzOf5nFX1hXD4g
TLSH
T16FF2EFFA07376105D99484B0E4009FCEAF16404B47B6B2EC76D447E3F7A21E2B1B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 d9a5209ad6c41cd60dd5831ced3facdf4ae1641bbc9d67178b825e06af5cbc9b
MD5 916b7c679d1c391fcd383192e4ad5664
SHA1 5e13f85783658b779f15da5f6403903fbeb4edcf
SHA512 ed97a00aced790c5654ca4bcf73d590a7b84cdfe75fe4d4603aa68af61e357906069d969f2a6ccbbdc48ea786f3576577a9fa6e17a46b47daa0e67d53e7f07c3
TLSH
T15AC0129280B9E472103C557D6D847883A67DD534005094A0D9D5D37CA1A34BB6B26079
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0f9200d07b390e483379544e4cabe648931537dd48e587ccb227cc4463b61eb3
MD5 fac05086bb43e4523bc9d4d8fe112f27
SHA1 6e9b63dbbd4dd50dd74e92b32eaea55055397c1f
SHA512 1a8e54a6da32379f2ccb6cdb93374f5bdc04a62765feed2d5506d4bdf59df8811d5937c668c90d7f3b90d5dd01b760167082ffe507c56cc89d539a9b3f3bbe32
SSDEEP 192:sxRgRDCm/fxsrWpVyK/U5zoA8p4rY/g6+WNIY979BBsigLIgFJ:sxRggm/fxsrWvyKMEyY/5IFfv
TLSH
T1DA42B7166D28A93B9CC7D25DFB6A7F53D2F91432A1D11E48AAFC8A1C01E76DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b9530f1bfb20c1ce4d686ec7409671cc77622db72e352096e6e782975b323462
MD5 80ed97442382c831f102b1a6673c8550
SHA1 51c2adaf887a188c1595b46e502f0738c602e536
SHA512 7146cac92c25ba6db9df13fab804cb6cb57d8ebe648671b7d1886cd4dd322eb5fa766786471041d3143330171723f66fcdc510cd3982346e79562d8e6489315c
SSDEEP 192:sxRgRDCm/fxs8WpVyy/U5zoA8p4rY/g6+WNIY979BBsl+GLIgFJ:sxRggm/fxs8WvyyMEyY/5IFl9v
TLSH
T19042A7166928A93B9CC7D25DFB6A7F53D2FD1432A1D11E48AAFC861C05E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7fdc570defbf7305868947dbf29f815048659c720709b1fab1e12b07e13974a5
MD5 cf14bd673b99fa89dcc3c47de0c9fd4e
SHA1 4b4a842c1e5ea00750b828a65ac4686207fcb814
SHA512 5ecee1d00b1e101ed02eb8b09951c82c1542ef2df318bca98483189173d9bebaffad4e0ef991552023a1442f5b491156cabf65828dec769a4152e59a657fb112
SSDEEP 192:sxRTRDCm/fxs9WpVyn/U5zoA8p4rY/g6+WNIY979jPsl+GLIgtJ:sxRTgm/fxs9WvynMEyY/5Ivl93
TLSH
T16142A7166928A93B9CC7D25DFB6A7F93D2F95432A1D11E48ABFC871C01E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e7638064b46f2805a92eb82adc56555b22f6446492c0fbb7ca6a37b727f7b36f
MD5 319bb1bc09874434628758136c1fa350
SHA1 73b6a45e0880f0db0d76bc566e3e305a12bac05d
SHA512 d0018bdcb738d003f72752e0dd855fd9efcc43e954639da8d5fd35fc2fa406e4b2cf7e66bcec4df66b74eea9e6a8abde5d91a75949c6c1587fbbd85fab502dd1
SSDEEP 192:sxRTRDCm/fxs9WpVyy/U5zoA8p4rY/g6+WNIY979BBsl+GLIgFJ:sxRTgm/fxs9WvyyMEyY/5IFl9v
TLSH
T16C42A8166928A93B9CC7D25DFB667F93D2FD1432A1D11E48ABFC861C05E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f1a4ad3e963583cd6bb507e01217b2da64f8315fecf6faa57d6df1e687e0ec80
MD5 83d2e9db2499085fcb1c992070a099fc
SHA1 3ee99445d0b9e332cdcda5e4626f8e2291d88fc6
SHA512 5b4937db592587a773e0d34fcbce329e9397f11cbd279966d88898ccabdbf56e5fdd3661e1cb903fd3b534288e1db1991698ee8d63f4a93521587a8e9b5bfe29
SSDEEP 768:ky2SgS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVASV4rroU+u:ky2SgqE7evWgd5f/bu1jaBU4Yju
TLSH
T1E6C2CA3B640CCB7F4F804ADDA8197F9A6DA802CB96D8CD8047FA951C03C6BEE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 5820cbde01e85949352cf1c07544c86a288af315c71000cb7af6a548a9f4d2d3
MD5 8c8c977d1ba5480b7fba8e19e5de622e
SHA1 16648fab4b1ef1e8d5cf78b475c9c44db9e74b49
SHA512 228f31db0e0b7d886646af638b1a919981721c3d18dbe8ea9284b3200c1862ae54068b4397439ca733e7a3073477591c17afcc2362c4e19685a3443755740404
TLSH
T1C2E0869026CAE57F616A61430A78A30CA2E8743BD7D83FC67FC4CD547743546BB93681
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 f599aeb122c44ad387878792a083a8b66f5395a50c516f276c84f6854a53fd97
MD5 32e922b002161a6d9c90d6ccb4240d6c
SHA1 bee62fef5e64780a5c12f9323c337c1005dc99bc
SHA512 65c710b8fbc4c1affa1d45742c665752caf1319f363166a16239b682437b1f4ec43d7b43492a3a60cccead40a245bbcaea16eae236c6fae5f43b7845094f05e4
TLSH
T1C5E0D86035CED63F61DA30874238E34C91A27426E6D82B917B4C998473075407743640
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 6c65b0b9685d02871eaf0498c1b5ecc331618e66e10160bb33de4db4e6fc787a
MD5 e2c77c5a11e89670220fcc2088600d66
SHA1 5e46f757bad17ce22ef008f83e85a736eb0aa1fb
SHA512 a33d15be0394e68fc25f149d94df3c3bc2e30bd09c5b83345096300741c31a3eeeccb4ea4b8dd83907947f63ea2e3d9977021cd59efdb6392644da23ccb5f096
TLSH
T1C9E080B07AC5D63F505561874674A74C92F4781697C43BC5AB4854906603246F7E5680
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a26caaa89c0ab3dfa4a784f6ec2687a46e6427f7e637543b15ae972f8e8f19fd
MD5 1b6a67da157c552449fb7ea6f25e5af9
SHA1 ce9536f2bafafca2c554dbcddb1585fd8899ead1
SHA512 8ea984de51beecfc98d07672d8665aaad02f64b504835c93f6b3e9caadbe2cb9241a46ac3cb9eee416f894c08b87da2b006a6a02dd64a2e86a94c26b21f894ab
SSDEEP 48:Kj2PKmgsIkYshPIhukKiBqokeG0fBgG5yJUIDKticWHIRKYA0fyD:KIB2KysCqUgKtiLHGKYAmg
TLSH
T1EC815497743E574128BE2E089958C61AD6C171B73259B82B77E804BA1F2FF021DFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 b207165936c333d417956d46c6934a8c444191fe207a63387529b2991449f276
MD5 c21e48f7c5b30b980117d48619bfe7d8
SHA1 94c256e697b3e1b798c94adabb16b1a0e87a4a70
SHA512 57347a411fe491a0dd5486b66f0e99081e2600288ba7fe3668cc1b5444cf83436c5466846750dd92aa41876675aa101f93e71a19ce759f2a0d039bfbf26f05f2
SSDEEP 384:DNrRZyCSDnxTICe1zYMEhIKyll7svbFKfk7:xFZJSDniP11yI1l7svbF9
TLSH
T13A44850A7B747001EDE6D9725CB080771E3C716E8F22A6D16DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 d4e1e7e344ab90160b3464bde8230309d959b95dd003642a66c11e8daee7546b
MD5 d34803af6213f107112b15bf68c3b76d
SHA1 1c42e1adb4b69313e92ec67ed3ba2a2db423f8fd
SHA512 f7089fd1bec641f38128c72ff19b57e39d3d035b2624a28d7f4cb2014facaf0e2ff2681f893222aa636abea84ee5477cb85b6ce544a8ab6dfdc17a624afd288d
SSDEEP 192:7QrIII6b6MIME1YcYP4LOPEAsDl9H+rsBw:7QrIII6b6MIMiBI9PNsJQs
TLSH
T1A34285BA160A1B3BC25F9F76536282849AE468C24032252E71533C5F8DF3F9786C57F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 ed1653a833dce96ebbb2f01c654060a91894ad11224faa149664daf1e2646a2e
MD5 5f1259710e3354dfee7f09d5a00e179c
SHA1 ff986b015557f0b557f8ddab2a255cb4724ef07d
SHA512 ef63092596221eb430e00f748c83d8f5da989e3e4cc12f092aa2b0d5761d8cc5572f595109c905960fa126a5c2dd0959ff799d5d924545e9e4f1745e8fc9efe8
TLSH
T1F4E026A0BCCAC16FF574308702349B0CC3803803EACA2BC62F41C484E603189FB8BAA1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 4457eb153859b771058cb4a2f5e22e40d1bd22a74ca3dc65cf7f1aa1b65a2aae
MD5 dd551719cf17d96523ee0f92e3115dda
SHA1 d3aa74658e3cf8a4cadb86fdf65e12f6c52b3fd3
SHA512 f1b32355cc3694829a5f8d71508908eddfb549e173ed0cc4f84941892e8a691c3f854a3aa7388b259d2c4738ad57539870c2cfc0a2b065b34c9d49a2eaec4530
TLSH
T17D210495F330C109E14A867E507B9B291739D8028FBCEC0F417964756EB6F040E4B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 23255f0ac998dae3ee43fb48a1be186e7084a53afe66c7278a6f7e9c10463d4c
MD5 c192baaed516874a46732038bad49b6a
SHA1 bbcff1c8fbca94bc26ff45dea0ffd296e60f7719
SHA512 23c67af5ca7efb0d96afc04487d4424ada45e9e9fd2e87e12ef5deb3bc7d19e7e3f82b2f7d4a0335bf8d7865b3b701f9aa00d27a4928d096892c826b5054a3ce
TLSH
T18CE020507CC6C15FA66020870275974CC3913803EAC42F813F41DC44A603186BF8B751
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 582106717625d0f74d6ece5e25753443a3e0b8a1e5d589c5af98f66698889698
MD5 fcb3dcd1dc60ff715a7aef4d53add11d
SHA1 1eed83448da0060420415072f54da44422843997
SHA512 8654e825d226e37ee25e41e661968ddce5c05191578cb05ea5c47f45fd1f6370f2ec215e061794148264e7fe9e989138e9606c9bce5f751daaa50bdf3188d1b0
SSDEEP 3:MsEllllkEthXllkl2zEfl29K/l:/M/xT02z/ol
TLSH
T1EB4404057FC00C0DCD005070C451C3731770F5300511574334D1C4337DC75404C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 4c6f141e178862a2aa94fd9b5157e58095cbeccb25dcbad888f2a0e1bb51c280
MD5 ca71566300e2b29741b15092b94806a9
SHA1 d3153125bf8dfb33815c5b7cffc9b44602491ee3
SHA512 ac8948a4b60e513b143f58bafc0a1a1ca28709ec5df958c9f37ba014aae61b54475eebd052b2877ead12b73308c48675418856d41fc9b94dd0d65f176f34b304
SSDEEP 3:MsEllllkEthXllkl2zEflUl:/M/xT02zbl
TLSH
T13F4404047FC00405CF041471C151C3531370D4300575574334D114335DCFF400C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 21ebc2046195dfe7fe1e50f4ef12a7aa14a2d0aa78ef8dc52f5c35a1c8523c75
MD5 169627f3fabf24480d9a91483d97c4ed
SHA1 964fcdfa0f2b31b58e77337663530d70377a8fbc
SHA512 df155e6dc5f4fc6ef2807fc09c62ce7318b71788f3567f75dfbcdca29a71fdc124a02bea17a0d02ca6f2cdbeba6ad64bee9c23dada7889e331e117efa9f56c28
SSDEEP 768:arv+4UNbdq371yqWnAam6aQMGdjWca4Ghfe/hlf:absbc3EBmaME6pK/
TLSH
T198F2AE31A8AC9973ADB79A95F22B7683BFB411A344D40E84DAD95B0C03975CD330BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 23330076cc5a884a6552e2633abaa0def0893697ae0580a00f4dc47773c4be66
MD5 a683d2f9294bd56e2607354d69077697
SHA1 042026a22835dc7fb09293abb27bc29c408a0f13
SHA512 7e102f9b3c44c6bff739b4c12edf5c89c5e3535c84b7f4ae8729a782809776dc915cdbd5a140e4463c3c08bf5abae2aa2179875e991515a7cd1a7e3d603906c6
SSDEEP 768:Frv+4UNbdq3w1yqWnAam6aQMGdjWca4Ghfe/hlf:Fbsbc3ZBmaME6pK/
TLSH
T1D4F2AE31A8ACA973ADB79A95F22B7683BFB411A344D40E84DAD95B0C03975CD330BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 992aec7f6433c700f8d16c41e233a3ca00458dd0835882437c397c7b83ee33ce
MD5 6a5d43697797d44b7e584d4f915b9b73
SHA1 88a61805e5c291bf26eab345e565b66813555979
SHA512 28fe3ff26c01aa48eaf7f82c7d53b080f6350d0d7ceef3e18f2abd0ff51481d72fd7693b0fcbe916dbc8a4b50a35bf88f5c3c635e237f8a27a6a005478e88318
SSDEEP 768:/rv+4UNbdq3CJq+AAam6aQMGdjWca4GhfB2PeU/:/bsbc3kKmaME6peH
TLSH
T1F2F2BE31A87C9973DDB79A99F21B6787BEF021A385D40E80D9D91B0D439748E3307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 da3b5db0992dc742ae317e447e201b7bd0464985a169d62220dd591b898d4811
MD5 944bda3ec4a724d1b7ccf15dd933788f
SHA1 69323536dcb96df977bad6c24e631f7d2648e1dd
SHA512 b3036dd277dace5dbacb5ec78c784f76fec7b47c0d92a30a4b6a6d6fe4752bb4b9e5ca91c505b56a4aa702afff9551e9901a9c5f8b85cbca92d970a6beb44d9b
SSDEEP 384:nUFCsrv+89zHqlDNP9oidq38N/8TUNTUlIliWpmiv3FIjEfcMMBeF7Iz5lf:UFNrv+4UNbdq3wwgF1uMKVlf
TLSH
T122B23932E868DA77EDF38BC1B60ABA47AFF010A785C859D4DAD85E4C01871DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 e0594f9fca2671529fb8c6fbb101ebe9547ec4be4ffa4d9976f9b2fd46799c57
MD5 d97c81559218938268f1a3bcfd7d8e27
SHA1 a430e99d5c91ed2e1c06da619a7ae56a1a957bc4
SHA512 b9964b87367271751406cad193659bec434140b7af3cf8b63b71df2a0dfb9c9a11e727b6b0312bb413c3e78c1d05312b6c9f8c138a64b854d28518ea79f8f06e
SSDEEP 768:2rv+4UNbdq3DsyqW8Aam6aQMGdjWca4Ghf9BWc32R+f:2bsbc3LumaME6pBWC2RQ
TLSH
T19D137B399C68983F8CAEB785B21E26537EA40273C5F40998D7D91B0CC2BB48DF307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 6287af6581090c3c6a8e1483c44bb5d10557e57351af2ddc63e3cb94e5d1fc1f
MD5 d71512ffaca4f68f3ea9a011b0d61ba4
SHA1 e6a108386c43f33be719c22b132cad297dc50123
SHA512 4edf4589d7b83496bda54e88a8334e9eaf9cf383bf122c9d6fa5447d2eabf0072c97c34846a0b91edcedcb0465dc7685b1ba94df81817d50e48af988eca958f0
SSDEEP 3:MsEllllkEthXllkl2zEflT:/M/xT02z6
TLSH
T1034404057FC00515CD4050714053C3517770D4300511DF4334D504335CCF7404C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 584B
SHA256 2abc15a8cff8db49a15c1a8a2cf5de07f6d7b38cfcf2bedbb1cdb525c9a5a719
MD5 e66fa6762a0ad4d13b59ba4aadd5e1b2
SHA1 b64b06e7620a315de5596a1bc0fa92de962c17f3
SHA512 32c3b964b218ad377c5aead8b3d74a06e3063aff90efe128dbf605bb84ee9b657e23d818d701bb70758ceff0d51c01696fdf1dd9355cce4ee6e20727c2dcd5bd
TLSH
T183F04113D1BE402DB09B23FFF4C9E96CD80D750100919A68002B81A1D4E4F92579E94F
MD5 SHA1 SHA512 TLSH

Submit Download

51f6fbfe-ff26-48ea-b114-958ec4874482.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\51f6fbfe-ff26-48ea-b114-958ec4874482.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads