a01a92af4ae21211bcea457d8151523d02ed0dfa8ffa71daf49babe82c59def2

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.vbs
Size 1KB
Sample260717-xa9fpsaz5p
SHA256 a01a92af4ae21211bcea457d8151523d02ed0dfa8ffa71daf49babe82c59def2
MD5 187f53986dc12eafae92d4e573a984e8
SHA1 af9a03d25166db0942f05364c197967edbb4eb77
SHA512 81942fa318ca8dba7d31ca7cbb89dde323a7dbdebe8accae113d4b664ff490a2cd1c4fffb99f18c5503c3435a6f821c587682c4d725ec612af23bc66329e8983
TLSH
T104310247FC01DEB1A172DEB20567B80ED36285179015C996BE5C80C56F3779DC9E50DC
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution exploit

Malware Config

Signatures

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WScript.exe

Disables Task Manager via registry modification
defense_evasion

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
8104	Process not Found
9148	Process not Found
8136	Process not Found
9252	Process not Found
6188	icacls.exe
6148	Process not Found
5124	icacls.exe
4644	icacls.exe
5884	Process not Found
7636	Process not Found
9992	Process not Found
7952	takeown.exe
7892	Process not Found
7424	Process not Found
6744	Process not Found
4216	Process not Found
7604	Process not Found
2392	Process not Found
8240	Process not Found
772	icacls.exe
4880	icacls.exe
7360	icacls.exe
9012	Process not Found
9308	Process not Found
6124	Process not Found
7612	Process not Found
5996	icacls.exe
8060	takeown.exe
1376	takeown.exe
7788	Process not Found
6624	Process not Found
9876	Process not Found
4668	takeown.exe
3324	takeown.exe
6760	Process not Found
4320	Process not Found
8056	Process not Found
7688	Process not Found
7628	Process not Found
6572	Process not Found
8004	icacls.exe
8900	Process not Found
8076	Process not Found
4864	icacls.exe
2000	Process not Found
2836	Process not Found
6204	Process not Found
6456	icacls.exe
440	takeown.exe
3020	Process not Found
9708	Process not Found
7408	Process not Found
4500	Process not Found
3244	Process not Found
1376	takeown.exe
6568	takeown.exe
8612	Process not Found
3780	Process not Found
5160	Process not Found
7876	Process not Found
6736	Process not Found
7624	Process not Found
4164	Process not Found
6304	Process not Found

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6124	Process not Found
3888	takeown.exe
6516	icacls.exe
8244	Process not Found
6876	Process not Found
9964	Process not Found
4504	Process not Found
9068	Process not Found
8780	Process not Found
2368	takeown.exe
5736	takeown.exe
6344	icacls.exe
8168	Process not Found
6940	Process not Found
2668	Process not Found
9076	Process not Found
6108	icacls.exe
4572	Process not Found
7872	Process not Found
8420	Process not Found
4092	Process not Found
5544	Process not Found
5608	Process not Found
9204	Process not Found
7800	Process not Found
1884	Process not Found
8368	Process not Found
3692	Process not Found
4172	takeown.exe
7440	icacls.exe
7660	Process not Found
7208	Process not Found
9328	Process not Found
1456	Process not Found
2656	Process not Found
8408	Process not Found
3724	Process not Found
7508	Process not Found
9920	Process not Found
4092	takeown.exe
7768	icacls.exe
6844	Process not Found
3184	Process not Found
6552	Process not Found
7908	Process not Found
4824	Process not Found
9360	Process not Found
9792	Process not Found
10232	Process not Found
6348	Process not Found
4740	takeown.exe
3460	takeown.exe
6448	Process not Found
6552	Process not Found
7592	Process not Found
4436	takeown.exe
872	takeown.exe
6500	Process not Found
7436	Process not Found
9864	Process not Found
8432	Process not Found
7148	takeown.exe
6716	icacls.exe
728	icacls.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
7824	WScript.exe
6712	Process not Found
8200	Process not Found
6632	Process not Found
7000	WScript.exe
5084	WScript.exe
5700	WScript.exe
5492	WScript.exe
3068	WScript.exe
4612	WScript.exe
5840	WScript.exe
7808	Process not Found
6484	Process not Found
6532	Process not Found
8004	Process not Found
5916	Process not Found
7888	Process not Found
5172	Process not Found
1340	WScript.exe
10000	Process not Found
9252	Process not Found
4196	WScript.exe
2288	WScript.exe
5336	WScript.exe
2400	WScript.exe
1780	WScript.exe
2312	WScript.exe
6524	WScript.exe
8580	Process not Found
4736	WScript.exe
8060	Process not Found
6260	Process not Found
8880	Process not Found
2324	Process not Found
3380	Process not Found
7500	Process not Found
5832	Process not Found
6504	Process not Found
5688	WScript.exe
1356	WScript.exe
3660	WScript.exe
1232	WScript.exe
9120	Process not Found
6648	Process not Found
1060	Process not Found
5864	WScript.exe
5848	WScript.exe
6276	WScript.exe
8172	WScript.exe
8020	Process not Found
7748	Process not Found
8220	Process not Found
8300	Process not Found
6068	WScript.exe
4272	Process not Found
5592	Process not Found
7756	Process not Found
9468	Process not Found
5776	WScript.exe
1116	WScript.exe
3000	WScript.exe
4488	WScript.exe
7260	WScript.exe
7112	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1760	cmd.exe
4084	cmd.exe
5740	cmd.exe
6508	cmd.exe
7572	cmd.exe
5180	Process not Found
4464	Process not Found
6408	Process not Found
5512	cmd.exe
5164	cmd.exe
4924	cmd.exe
4080	cmd.exe
5168	Process not Found
7068	Process not Found
8548	Process not Found
4956	Process not Found
2416	cmd.exe
7644	Process not Found
772	Process not Found
3676	Process not Found
6924	Process not Found
8228	Process not Found
6480	Process not Found
7932	Process not Found
9092	Process not Found
6400	Process not Found
7272	Process not Found
1972	cmd.exe
7356	cmd.exe
6224	Process not Found
3488	cmd.exe
1728	cmd.exe
4684	Process not Found
3064	cmd.exe
6116	cmd.exe
792	cmd.exe
7524	Process not Found
4360	Process not Found
5200	cmd.exe
5672	cmd.exe
1612	Process not Found
1868	cmd.exe
1208	cmd.exe
6340	cmd.exe
4240	Process not Found
9604	Process not Found
5752	cmd.exe
5656	cmd.exe
6240	cmd.exe
6600	cmd.exe
6936	cmd.exe
7548	Process not Found
6748	Process not Found
2532	Process not Found
2340	cmd.exe
8164	cmd.exe
7144	Process not Found
4244	Process not Found
6604	Process not Found
9952	Process not Found
10228	Process not Found
4568	Process not Found
2172	cmd.exe
940	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	WScript.exe

Runs net.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2172	2932	WScript.exe	89
PID 2172 wrote to memory of 1812	2172	cmd.exe	91
PID 2932 wrote to memory of 5084	2932	WScript.exe	92
PID 1812 wrote to memory of 3232	1812	net.exe	1285
PID 5084 wrote to memory of 940	5084	WScript.exe	95
PID 2932 wrote to memory of 4460	2932	WScript.exe	598
PID 940 wrote to memory of 2068	940	cmd.exe	98

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
1⤵
- Disables RegEdit via registry modification
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\cmd.exe
  cmd /c net session
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3232
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
  2⤵
  - Disables RegEdit via registry modification
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\System32\cmd.exe
    cmd /c net session
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:2068
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1440
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5700
  - - C:\Windows\System32\cmd.exe
      cmd /c net session
      4⤵
      Executes a command shell one-liner
      PID:5512
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:1624
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:3552
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
      4⤵
      PID:4484
    - - C:\Windows\System32\cmd.exe
        
        cmd /c net session
        5⤵
        Executes a command shell one-liner
        
        PID:5164
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:3240
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:4884
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        5⤵
        
        PID:5040
      - C:\Windows\System32\cmd.exe
        
        cmd /c net session
        6⤵
        Executes a command shell one-liner
        
        PID:1868
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:2332
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:1420
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5776
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        7⤵
        Executes a command shell one-liner
        
        PID:3064
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:4132
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:3904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        7⤵
        
        PID:4700
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        8⤵
        Executes a command shell one-liner
        
        PID:1208
        
        C:\Windows\system32\net.exe
        
        net session
        9⤵
        
        PID:4764
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        10⤵
        
        PID:2716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        8⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5492
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        9⤵
        Executes a command shell one-liner
        
        PID:5200
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:4688
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:4268
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        9⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4736
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        10⤵
        
        PID:3440
        
        C:\Windows\system32\net.exe
        
        net session
        11⤵
        
        PID:5616
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        12⤵
        
        PID:4368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        10⤵
        
        PID:1464
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        11⤵
        
        PID:1996
        
        C:\Windows\system32\net.exe
        
        net session
        12⤵
        
        PID:712
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        13⤵
        
        PID:1792
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        11⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3068
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        12⤵
        Executes a command shell one-liner
        
        PID:2340
        
        C:\Windows\system32\net.exe
        
        net session
        13⤵
        
        PID:836
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        14⤵
        
        PID:3564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        12⤵
        
        PID:1364
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        13⤵
        Executes a command shell one-liner
        
        PID:5672
        
        C:\Windows\system32\net.exe
        
        net session
        14⤵
        
        PID:5760
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        15⤵
        
        PID:2416
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        13⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6068
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        14⤵
        
        PID:2744
        
        C:\Windows\system32\net.exe
        
        net session
        15⤵
        
        PID:4928
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        16⤵
        
        PID:4320
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        14⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5336
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        15⤵
        Executes a command shell one-liner
        
        PID:1760
        
        C:\Windows\system32\net.exe
        
        net session
        16⤵
        
        PID:4632
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        17⤵
        
        PID:952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        15⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2400
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        16⤵
        Executes a command shell one-liner
        
        PID:6116
        
        C:\Windows\system32\net.exe
        
        net session
        17⤵
        
        PID:5008
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        18⤵
        
        PID:5544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        16⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5688
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        17⤵
        
        PID:1984
        
        C:\Windows\system32\net.exe
        
        net session
        18⤵
        
        PID:4120
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        19⤵
        
        PID:6084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        17⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1780
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        18⤵
        Executes a command shell one-liner
        
        PID:4084
        
        C:\Windows\system32\net.exe
        
        net session
        19⤵
        
        PID:6104
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        20⤵
        
        PID:3028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        18⤵
        
        PID:5532
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        19⤵
        
        PID:5796
        
        C:\Windows\system32\net.exe
        
        net session
        20⤵
        
        PID:2716
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        21⤵
        
        PID:5476
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        19⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1116
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        20⤵
        Executes a command shell one-liner
        
        PID:3488
        
        C:\Windows\system32\net.exe
        
        net session
        21⤵
        
        PID:2156
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        22⤵
        
        PID:3336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        20⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5848
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        21⤵
        
        PID:5268
        
        C:\Windows\system32\net.exe
        
        net session
        22⤵
        
        PID:3176
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        23⤵
        
        PID:3320
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        21⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2288
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        22⤵
        
        PID:5488
        
        C:\Windows\system32\net.exe
        
        net session
        23⤵
        
        PID:2436
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        24⤵
        
        PID:5724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        22⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3000
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        23⤵
        Executes a command shell one-liner
        
        PID:5752
        
        C:\Windows\system32\net.exe
        
        net session
        24⤵
        
        PID:5124
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        25⤵
        
        PID:4932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        23⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4196
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        24⤵
        Executes a command shell one-liner
        
        PID:5656
        
        C:\Windows\system32\net.exe
        
        net session
        25⤵
        
        PID:3016
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        26⤵
        
        PID:3660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        24⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5864
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        25⤵
        Executes a command shell one-liner
        
        PID:792
        
        C:\Windows\system32\net.exe
        
        net session
        26⤵
        
        PID:2956
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        27⤵
        
        PID:2216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        25⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1356
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        26⤵
        Executes a command shell one-liner
        
        PID:5740
        
        C:\Windows\system32\net.exe
        
        net session
        27⤵
        
        PID:5856
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        28⤵
        
        PID:1376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        26⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1340
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        27⤵
        Executes a command shell one-liner
        
        PID:1728
        
        C:\Windows\system32\net.exe
        
        net session
        28⤵
        
        PID:6172
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        29⤵
        
        PID:6308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        27⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3660
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        28⤵
        Executes a command shell one-liner
        
        PID:6240
        
        C:\Windows\system32\net.exe
        
        net session
        29⤵
        
        PID:7092
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        30⤵
        
        PID:4912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        28⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7000
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        29⤵
        Executes a command shell one-liner
        
        PID:4924
        
        C:\Windows\system32\net.exe
        
        net session
        30⤵
        
        PID:4752
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        31⤵
        
        PID:6340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        29⤵
        
        PID:6772
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        30⤵
        Executes a command shell one-liner
        
        PID:6600
        
        C:\Windows\system32\net.exe
        
        net session
        31⤵
        
        PID:468
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        32⤵
        
        PID:7132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        30⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1232
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        31⤵
        
        PID:7072
        
        C:\Windows\system32\net.exe
        
        net session
        32⤵
        
        PID:2852
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        33⤵
        
        PID:2216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        31⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4488
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        32⤵
        Executes a command shell one-liner
        
        PID:2416
        
        C:\Windows\system32\net.exe
        
        net session
        33⤵
        
        PID:3320
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        34⤵
        
        PID:5676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        32⤵
        
        PID:7104
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        33⤵
        
        PID:2216
        
        C:\Windows\system32\net.exe
        
        net session
        34⤵
        
        PID:6248
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        35⤵
        
        PID:2044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        33⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2312
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        34⤵
        
        PID:6412
        
        C:\Windows\system32\net.exe
        
        net session
        35⤵
        
        PID:6384
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        36⤵
        
        PID:2432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        34⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6276
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        35⤵
        
        PID:2596
        
        C:\Windows\system32\net.exe
        
        net session
        36⤵
        
        PID:2432
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        37⤵
        
        PID:6776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        35⤵
        
        PID:6964
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        36⤵
        Executes a command shell one-liner
        
        PID:6936
        
        C:\Windows\system32\net.exe
        
        net session
        37⤵
        
        PID:6768
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        38⤵
        
        PID:5168
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        36⤵
        
        PID:2080
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        37⤵
        Executes a command shell one-liner
        
        PID:6340
        
        C:\Windows\system32\net.exe
        
        net session
        38⤵
        
        PID:6900
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        39⤵
        
        PID:6852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        37⤵
        
        PID:6724
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        38⤵
        Executes a command shell one-liner
        
        PID:1972
        
        C:\Windows\system32\net.exe
        
        net session
        39⤵
        
        PID:6860
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        40⤵
        
        PID:4940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        38⤵
        
        PID:6280
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        39⤵
        Executes a command shell one-liner
        
        PID:6508
        
        C:\Windows\system32\net.exe
        
        net session
        40⤵
        
        PID:7380
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        41⤵
        
        PID:7548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        39⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4612
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        40⤵
        Executes a command shell one-liner
        
        PID:7572
        
        C:\Windows\system32\net.exe
        
        net session
        41⤵
        
        PID:6536
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        42⤵
        
        PID:3092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        40⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5840
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        41⤵
        Executes a command shell one-liner
        
        PID:8164
        
        C:\Windows\system32\net.exe
        
        net session
        42⤵
        
        PID:7304
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        43⤵
        
        PID:6552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        41⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7260
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        42⤵
        
        PID:4692
        
        C:\Windows\system32\net.exe
        
        net session
        43⤵
        
        PID:5632
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        44⤵
        
        PID:6552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        42⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7824
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        43⤵
        Executes a command shell one-liner
        
        PID:4080
        
        C:\Windows\system32\net.exe
        
        net session
        44⤵
        
        PID:7760
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        45⤵
        
        PID:7400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        43⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8172
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        44⤵
        Executes a command shell one-liner
        
        PID:7356
        
        C:\Windows\system32\net.exe
        
        net session
        45⤵
        
        PID:6360
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        46⤵
        
        PID:7156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
        44⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6524
        
        C:\Windows\System32\cmd.exe
        
        cmd /c net session
        45⤵
        
        PID:6612
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        44⤵
        
        PID:6468
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        43⤵
        
        PID:7520
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        43⤵
        
        PID:2672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        42⤵
        
        PID:8184
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        42⤵
        
        PID:7612
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        42⤵
        
        PID:988
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        41⤵
        
        PID:7992
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:6760
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        41⤵
        
        PID:7316
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        41⤵
        
        PID:6572
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        40⤵
        
        PID:7044
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:7020
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        40⤵
        
        PID:6844
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        40⤵
        
        PID:6532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        40⤵
        
        PID:7976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        39⤵
        
        PID:7272
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:7344
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        39⤵
        
        PID:7116
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:4960
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        39⤵
        
        PID:7348
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        39⤵
        
        PID:8180
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        38⤵
        
        PID:2568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:6660
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        38⤵
        
        PID:6924
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:7176
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        38⤵
        
        PID:7736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        38⤵
        
        PID:7888
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        38⤵
        
        PID:6648
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        37⤵
        
        PID:2600
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:6612
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        37⤵
        
        PID:7116
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        37⤵
        
        PID:6660
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        37⤵
        
        PID:7432
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        37⤵
        Possible privilege escalation attempt
        
        PID:8004
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        37⤵
        
        PID:4748
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        36⤵
        
        PID:1456
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:3820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        36⤵
        
        PID:6216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:1664
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        36⤵
        
        PID:8076
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:5976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        36⤵
        Possible privilege escalation attempt
        
        PID:8060
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        36⤵
        
        PID:7420
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        35⤵
        
        PID:3232
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:6792
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        35⤵
        
        PID:3448
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:7132
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        35⤵
        
        PID:8152
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:6776
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        35⤵
        
        PID:3244
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        35⤵
        
        PID:8032
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        35⤵
        
        PID:7196
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        34⤵
        
        PID:3460
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:6548
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        34⤵
        
        PID:7132
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:6344
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        34⤵
        
        PID:6864
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:6192
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        34⤵
        
        PID:7748
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:7148
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        34⤵
        
        PID:7684
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        34⤵
        
        PID:7144
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        34⤵
        
        PID:4440
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        33⤵
        
        PID:6724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:6988
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        33⤵
        
        PID:5264
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:620
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        33⤵
        
        PID:7016
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:6664
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        33⤵
        
        PID:7920
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:7612
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        33⤵
        
        PID:7316
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        33⤵
        
        PID:4308
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        33⤵
        
        PID:7880
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        32⤵
        
        PID:6188
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:6300
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        32⤵
        
        PID:1804
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:3148
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        32⤵
        
        PID:6060
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:2396
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        32⤵
        
        PID:2560
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:6208
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        32⤵
        
        PID:1576
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:7788
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        32⤵
        
        PID:6260
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        32⤵
        
        PID:7016
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        32⤵
        
        PID:3060
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        31⤵
        
        PID:6984
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:6484
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        31⤵
        
        PID:7112
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:6716
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        31⤵
        
        PID:5344
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:3736
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        31⤵
        
        PID:3236
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:6552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        31⤵
        
        PID:6304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:6976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        31⤵
        
        PID:7988
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        31⤵
        
        PID:8080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        31⤵
        
        PID:7360
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        30⤵
        
        PID:6548
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:6888
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        30⤵
        
        PID:2376
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:708
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        30⤵
        
        PID:1456
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:6548
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        30⤵
        
        PID:6940
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:6648
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        30⤵
        
        PID:7320
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:1196
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        30⤵
        
        PID:620
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:7660
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        30⤵
        
        PID:4360
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        30⤵
        
        PID:7528
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        29⤵
        
        PID:6800
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:6892
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        29⤵
        
        PID:6592
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:5168
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        29⤵
        
        PID:3244
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:6840
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        29⤵
        
        PID:3460
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:4476
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        29⤵
        
        PID:2396
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:4476
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        29⤵
        
        PID:7520
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:6928
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        29⤵
        
        PID:7844
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        29⤵
        
        PID:7508
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        28⤵
        
        PID:4360
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:6908
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        28⤵
        
        PID:6992
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:4080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        28⤵
        Possible privilege escalation attempt
        
        PID:440
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:6784
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        28⤵
        
        PID:6300
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:6368
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        28⤵
        
        PID:5264
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:7120
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        28⤵
        
        PID:6708
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        28⤵
        
        PID:7244
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        28⤵
        
        PID:7816
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        28⤵
        Modifies file permissions
        
        PID:7768
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        28⤵
        
        PID:6552
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        27⤵
        
        PID:6256
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6648
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        27⤵
        
        PID:6324
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6884
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        27⤵
        
        PID:3464
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:2660
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        27⤵
        
        PID:7160
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6916
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        27⤵
        
        PID:3852
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6408
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        27⤵
        
        PID:7288
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:5920
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        27⤵
        
        PID:7436
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6164
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        27⤵
        
        PID:7164
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        27⤵
        
        PID:6400
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        26⤵
        
        PID:4488
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6284
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        26⤵
        
        PID:5280
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:3508
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        26⤵
        
        PID:4148
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:7008
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        26⤵
        
        PID:4524
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        26⤵
        
        PID:5884
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:1372
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        26⤵
        
        PID:4888
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:6896
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        26⤵
        
        PID:7056
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:7792
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        26⤵
        
        PID:2324
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        26⤵
        
        PID:7940
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        26⤵
        
        PID:8140
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        25⤵
        
        PID:1188
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:2416
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        25⤵
        
        PID:7084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6988
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        25⤵
        
        PID:6400
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6412
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        25⤵
        
        PID:6756
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:4476
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        25⤵
        
        PID:6164
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:3104
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        25⤵
        
        PID:6788
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:6316
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        25⤵
        
        PID:7780
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:8140
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        25⤵
        
        PID:5544
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        25⤵
        
        PID:7336
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        25⤵
        
        PID:7644
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        25⤵
        Possible privilege escalation attempt
        
        PID:6188
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        24⤵
        
        PID:5920
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:2080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        24⤵
        
        PID:3464
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:6708
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        24⤵
        
        PID:624
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:2224
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        24⤵
        Modifies file permissions
        
        PID:7148
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:6760
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        24⤵
        
        PID:4108
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:3448
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        24⤵
        
        PID:6180
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:6524
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        24⤵
        
        PID:6676
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:4960
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        24⤵
        
        PID:7904
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:6500
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        24⤵
        
        PID:6456
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        24⤵
        
        PID:7056
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        23⤵
        
        PID:5832
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:4960
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        23⤵
        
        PID:440
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:4204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        23⤵
        
        PID:6568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:5976
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        23⤵
        
        PID:3340
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:5168
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        23⤵
        
        PID:6164
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:816
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        23⤵
        
        PID:6304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:6648
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        23⤵
        
        PID:7076
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:7020
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        23⤵
        
        PID:6944
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:8012
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        23⤵
        
        PID:7996
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        23⤵
        
        PID:7576
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        23⤵
        
        PID:6896
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        22⤵
        
        PID:4460
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6060
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        22⤵
        
        PID:4844
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:1644
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        22⤵
        
        PID:4324
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6620
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        22⤵
        
        PID:1744
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6580
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        22⤵
        
        PID:5396
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6628
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        22⤵
        
        PID:4248
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6912
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        22⤵
        
        PID:4600
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6524
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        22⤵
        
        PID:872
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        22⤵
        
        PID:6636
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        22⤵
        
        PID:1112
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        22⤵
        Possible privilege escalation attempt
        
        PID:7360
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        22⤵
        
        PID:5396
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        22⤵
        Modifies file permissions
        
        PID:728
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        22⤵
        
        PID:6816
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        21⤵
        
        PID:4840
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:4248
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        21⤵
        
        PID:3664
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:4864
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        21⤵
        
        PID:3192
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:6716
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        21⤵
        
        PID:3216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:6332
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        21⤵
        
        PID:7156
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:3060
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        21⤵
        
        PID:6236
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:7144
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        21⤵
        
        PID:4308
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:4112
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        21⤵
        
        PID:6968
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:5304
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        21⤵
        
        PID:7164
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:7400
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        21⤵
        
        PID:7328
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        21⤵
        
        PID:7684
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        20⤵
        Possible privilege escalation attempt
        
        PID:1376
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:1372
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        20⤵
        
        PID:1644
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:2444
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        20⤵
        
        PID:4204
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:1664
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        20⤵
        
        PID:3780
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:7164
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        20⤵
        
        PID:4472
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:6664
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        20⤵
        
        PID:7044
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:6748
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        20⤵
        
        PID:6788
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:7040
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        20⤵
        
        PID:7112
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:6732
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        20⤵
        
        PID:2564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:7736
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        20⤵
        
        PID:7848
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:7236
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        20⤵
        
        PID:8084
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        20⤵
        
        PID:7264
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        20⤵
        
        PID:7744
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        19⤵
        
        PID:5724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:3888
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        19⤵
        
        PID:4284
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:4496
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        19⤵
        
        PID:2564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:4504
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        19⤵
        
        PID:2660
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:1332
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        19⤵
        
        PID:6888
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:6664
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        19⤵
        
        PID:6704
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:4544
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        19⤵
        
        PID:6224
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:6672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        19⤵
        
        PID:1596
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:6528
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        19⤵
        
        PID:3888
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:2992
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        19⤵
        
        PID:7744
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:7956
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        19⤵
        
        PID:1264
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:8008
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        19⤵
        
        PID:7772
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        19⤵
        
        PID:7956
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        18⤵
        
        PID:4284
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:3676
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        18⤵
        
        PID:2104
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:4160
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        18⤵
        
        PID:2564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:5228
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        18⤵
        
        PID:2528
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:4424
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        18⤵
        
        PID:5832
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:7052
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        18⤵
        
        PID:6588
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:4268
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        18⤵
        
        PID:6460
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:1188
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        18⤵
        
        PID:6812
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:5676
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        18⤵
        
        PID:4204
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:6256
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        18⤵
        
        PID:2672
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:8172
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        18⤵
        
        PID:6792
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:7408
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        18⤵
        
        PID:3112
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        18⤵
        
        PID:2308
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        17⤵
        
        PID:4476
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:4916
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        17⤵
        
        PID:5884
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:2312
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        17⤵
        
        PID:1356
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:2312
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        17⤵
        
        PID:728
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:4080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        17⤵
        
        PID:2324
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:6660
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        17⤵
        
        PID:5304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:4476
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        17⤵
        
        PID:6180
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:1948
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        17⤵
        
        PID:5840
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:2324
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        17⤵
        
        PID:4152
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:3464
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        17⤵
        
        PID:7112
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:4320
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        17⤵
        
        PID:6800
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:7248
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        17⤵
        
        PID:7468
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        17⤵
        
        PID:4932
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        17⤵
        
        PID:7412
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        16⤵
        
        PID:4960
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:1616
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        16⤵
        
        PID:3724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:2452
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        16⤵
        
        PID:4216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:3772
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        16⤵
        
        PID:3508
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:1340
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        16⤵
        
        PID:4172
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:2568
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        16⤵
        
        PID:4172
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6828
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        16⤵
        
        PID:3152
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6288
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        16⤵
        
        PID:4472
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6568
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        16⤵
        
        PID:3216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:5920
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        16⤵
        
        PID:6812
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:4692
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        16⤵
        Modifies file permissions
        
        PID:3460
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        16⤵
        Modifies file permissions
        
        PID:7440
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        16⤵
        
        PID:4308
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:6804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        16⤵
        
        PID:7692
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        16⤵
        
        PID:872
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        16⤵
        
        PID:6216
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        15⤵
        
        PID:2920
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:5036
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        15⤵
        
        PID:2996
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:952
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        15⤵
        
        PID:1356
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:3448
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        15⤵
        
        PID:2016
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:4240
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        15⤵
        
        PID:4496
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:2928
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        15⤵
        
        PID:4320
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:4360
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        15⤵
        
        PID:6652
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:6148
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        15⤵
        
        PID:4092
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:6404
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        15⤵
        
        PID:1196
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:4480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        15⤵
        
        PID:6816
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:7116
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        15⤵
        
        PID:4860
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:1576
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        15⤵
        
        PID:7312
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:7184
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        15⤵
        
        PID:3736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:7436
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        15⤵
        
        PID:7428
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
        15⤵
        
        PID:7264
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        14⤵
        
        PID:4864
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:4476
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        14⤵
        
        PID:3664
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:2592
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        14⤵
        
        PID:4524
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:1340
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        14⤵
        
        PID:4556
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:956
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        14⤵
        
        PID:5732
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:5668
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        14⤵
        
        PID:4860
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:2168
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        14⤵
        
        PID:1188
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:1456
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        14⤵
        
        PID:5264
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:7008
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        14⤵
        
        PID:5668
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:1596
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        14⤵
        
        PID:6568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:4860
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        14⤵
        
        PID:6448
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:4732
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        14⤵
        
        PID:7216
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:5544
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        14⤵
        
        PID:6912
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        14⤵
        
        PID:7544
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        14⤵
        Possible privilege escalation attempt
        
        PID:7952
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        13⤵
        
        PID:2860
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:3348
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        13⤵
        Possible privilege escalation attempt
        
        PID:4668
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:5148
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        13⤵
        
        PID:2988
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:3640
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        13⤵
        
        PID:1064
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        13⤵
        Modifies file permissions
        
        PID:6108
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        13⤵
        Modifies file permissions
        
        PID:2368
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:1232
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        13⤵
        
        PID:2568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:1320
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        13⤵
        
        PID:1884
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:3820
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        13⤵
        
        PID:4564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:1320
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        13⤵
        
        PID:1928
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:6948
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        13⤵
        
        PID:6700
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:6628
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        13⤵
        
        PID:6460
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:2380
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        13⤵
        
        PID:4360
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:4216
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        13⤵
        
        PID:8144
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:4896
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        13⤵
        
        PID:6640
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
        13⤵
        
        PID:8096
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        12⤵
        
        PID:5740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:5688
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        12⤵
        
        PID:2736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:4112
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        12⤵
        
        PID:5304
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:4984
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        12⤵
        
        PID:1408
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:944
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        12⤵
        
        PID:2564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:1456
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        12⤵
        Possible privilege escalation attempt
        
        PID:1376
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:1948
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        12⤵
        
        PID:1948
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:2740
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        12⤵
        
        PID:6204
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:3320
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        12⤵
        
        PID:6472
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        12⤵
        Modifies file permissions
        
        PID:6516
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        12⤵
        
        PID:4732
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:6612
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        12⤵
        
        PID:7032
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:3912
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        12⤵
        
        PID:4360
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:5840
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        12⤵
        
        PID:6408
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:6164
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        12⤵
        
        PID:6784
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
        12⤵
        
        PID:3736
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertToSplit.crw >nul 2>&1
        12⤵
        
        PID:3112
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        11⤵
        
        PID:3460
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:1656
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        11⤵
        
        PID:2740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:304
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        11⤵
        
        PID:4220
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:4840
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        11⤵
        
        PID:4960
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:2292
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        11⤵
        
        PID:5544
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:4196
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        11⤵
        
        PID:4524
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:4564
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        11⤵
        
        PID:1372
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:1948
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        11⤵
        
        PID:3348
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:620
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        11⤵
        
        PID:6840
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:7144
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        11⤵
        
        PID:7076
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:5936
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        11⤵
        
        PID:7056
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:6804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        11⤵
        
        PID:1664
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:1324
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        11⤵
        
        PID:4088
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:7512
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        11⤵
        
        PID:1324
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:7608
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertToSplit.crw >nul 2>&1
        11⤵
        
        PID:1196
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertToSplit.crw" /grant Administrators:F >nul 2>&1
        11⤵
        
        PID:2104
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        10⤵
        
        PID:4552
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        10⤵
        
        PID:4644
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:4204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        10⤵
        Modifies file permissions
        
        PID:4740
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:956
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        10⤵
        
        PID:5656
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:5988
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        10⤵
        
        PID:5404
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:2452
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        10⤵
        
        PID:2988
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:2996
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        10⤵
        
        PID:2000
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:2452
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        10⤵
        
        PID:2568
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:7132
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        10⤵
        
        PID:7120
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:6148
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        10⤵
        
        PID:2600
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:6532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        10⤵
        
        PID:6628
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:7080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        10⤵
        
        PID:6940
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:6192
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        10⤵
        
        PID:1076
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:7960
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        10⤵
        
        PID:6984
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:7344
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertToSplit.crw >nul 2>&1
        10⤵
        
        PID:944
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertToSplit.crw" /grant Administrators:F >nul 2>&1
        10⤵
        
        PID:7136
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        10⤵
        
        PID:6904
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        9⤵
        
        PID:2592
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:5532
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        9⤵
        Modifies file permissions
        
        PID:4436
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:4080
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        9⤵
        
        PID:4692
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:2416
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        9⤵
        
        PID:6016
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:4112
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        9⤵
        
        PID:3192
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:1804
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        9⤵
        
        PID:1744
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:2044
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        9⤵
        
        PID:1420
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:1264
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        9⤵
        
        PID:1972
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:2964
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        9⤵
        
        PID:1008
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        9⤵
        Modifies file permissions
        
        PID:6344
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        9⤵
        
        PID:6688
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6324
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        9⤵
        Modifies file permissions
        
        PID:872
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:6688
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        9⤵
        
        PID:6508
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:2592
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        9⤵
        
        PID:6908
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:5632
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        9⤵
        
        PID:1076
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
        9⤵
        Possible privilege escalation attempt
        
        PID:4880
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertToSplit.crw >nul 2>&1
        9⤵
        
        PID:3724
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertToSplit.crw" /grant Administrators:F >nul 2>&1
        9⤵
        
        PID:8132
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        9⤵
        Possible privilege escalation attempt
        
        PID:6568
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        8⤵
        
        PID:1112
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:3336
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        8⤵
        
        PID:4968
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:3348
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        8⤵
        
        PID:2156
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:2292
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        8⤵
        
        PID:2996
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4160
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        8⤵
        Possible privilege escalation attempt
        
        PID:3324
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        8⤵
        Possible privilege escalation attempt
        
        PID:5996
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        8⤵
        
        PID:3752
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:3192
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        8⤵
        
        PID:2596
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4352
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        8⤵
        
        PID:4560
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4672
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        8⤵
        
        PID:2000
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4308
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        8⤵
        
        PID:6420
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4204
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        8⤵
        
        PID:4968
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6248
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        8⤵
        
        PID:2928
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6472
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        8⤵
        
        PID:4524
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6592
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        8⤵
        
        PID:3564
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:4920
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertToSplit.crw >nul 2>&1
        8⤵
        
        PID:7608
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertToSplit.crw" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:7700
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        8⤵
        
        PID:1372
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6468
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExpandSubmit.DVR-MS >nul 2>&1
        8⤵
        
        PID:8148
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExpandSubmit.DVR-MS" /grant Administrators:F >nul 2>&1
        8⤵
        
        PID:6516
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        7⤵
        Modifies file permissions
        
        PID:3888
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:4076
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        7⤵
        
        PID:1264
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:5508
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        7⤵
        
        PID:4880
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:816
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        7⤵
        
        PID:4128
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:1656
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        7⤵
        
        PID:1504
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:624
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        7⤵
        
        PID:2512
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:1320
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        7⤵
        
        PID:1896
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:728
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        7⤵
        Modifies file permissions
        
        PID:5736
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:2292
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        7⤵
        
        PID:4108
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:4148
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        7⤵
        
        PID:4156
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:3220
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        7⤵
        
        PID:4560
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6232
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        7⤵
        
        PID:6160
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        7⤵
        Possible privilege escalation attempt
        
        PID:6456
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        7⤵
        
        PID:6664
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:4480
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        7⤵
        
        PID:7164
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
        7⤵
        Modifies file permissions
        
        PID:6716
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertToSplit.crw >nul 2>&1
        7⤵
        
        PID:2660
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertToSplit.crw" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:8108
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        7⤵
        
        PID:7244
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        7⤵
        
        PID:6988
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExpandSubmit.DVR-MS >nul 2>&1
        7⤵
        
        PID:2720
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExpandSubmit.DVR-MS" /grant Administrators:F >nul 2>&1
        7⤵
        Possible privilege escalation attempt
        
        PID:4644
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FindUpdate.eps >nul 2>&1
        7⤵
        
        PID:7308
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        6⤵
        
        PID:1728
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:3368
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        6⤵
        
        PID:956
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:1276
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        6⤵
        Modifies file permissions
        
        PID:4092
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:2240
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        6⤵
        
        PID:4400
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:4888
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        6⤵
        
        PID:4536
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:4368
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        6⤵
        
        PID:5980
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:1948
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        6⤵
        
        PID:5832
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:5664
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        6⤵
        
        PID:2996
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:3212
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        6⤵
        
        PID:3016
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:3220
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        6⤵
        
        PID:5648
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:2372
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        6⤵
        
        PID:4476
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:2720
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        6⤵
        
        PID:6300
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:3852
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        6⤵
        
        PID:4600
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:6896
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        6⤵
        
        PID:3236
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:3236
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertToSplit.crw >nul 2>&1
        6⤵
        
        PID:2132
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertToSplit.crw" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:2372
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        6⤵
        
        PID:6976
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:7196
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExpandSubmit.DVR-MS >nul 2>&1
        6⤵
        
        PID:1420
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExpandSubmit.DVR-MS" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:7060
      - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FindUpdate.eps >nul 2>&1
        6⤵
        
        PID:4480
      - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\FindUpdate.eps" /grant Administrators:F >nul 2>&1
        6⤵
        
        PID:8036
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
        5⤵
        
        PID:6096
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:2092
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
        5⤵
        
        PID:2580
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:2960
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
        5⤵
        
        PID:4740
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:924
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
        5⤵
        
        PID:1928
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:5920
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
        5⤵
        
        PID:5316
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:2536
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f >nul 2>&1
        5⤵
        
        PID:4644
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4160
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
        5⤵
        
        PID:624
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:3236
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
        5⤵
        
        PID:4088
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:5668
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
        5⤵
        
        PID:5724
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4380
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
        5⤵
        
        PID:2672
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:1928
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
        5⤵
        
        PID:7044
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6248
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
        5⤵
        
        PID:2740
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6824
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
        5⤵
        
        PID:6444
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4216
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
        5⤵
        
        PID:6448
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
        5⤵
        Possible privilege escalation attempt
        
        PID:4864
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertToSplit.crw >nul 2>&1
        5⤵
        
        PID:3192
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertToSplit.crw" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:4380
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
        5⤵
        
        PID:6908
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:7016
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExpandSubmit.DVR-MS >nul 2>&1
        5⤵
        
        PID:8028
    - - C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" "C:\Program Files\ExpandSubmit.DVR-MS" /grant Administrators:F >nul 2>&1
        5⤵
        
        PID:6148
    - - C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Program Files\FindUpdate.eps >nul 2>&1
        5⤵
        
        PID:7656
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
      4⤵
      PID:3028
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
      4⤵
      PID:3940
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
      4⤵
      PID:3352
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
      4⤵
      PID:1228
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
      4⤵
      PID:2204
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4108
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
      4⤵
      PID:4692
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
      4⤵
      PID:2840
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
      4⤵
      PID:5668
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
      4⤵
      PID:1680
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f >nul 2>&1
      4⤵
      PID:4308
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
      4⤵
      PID:2288
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
      4⤵
      PID:5160
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4152
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
      4⤵
      PID:4092
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6060
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
      4⤵
      PID:708
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4912
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
      4⤵
      PID:2016
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4668
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
      4⤵
      PID:4128
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
      4⤵
      PID:2720
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
      4⤵
      PID:6560
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
      4⤵
      PID:3852
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
      4⤵
      PID:6768
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
      4⤵
      PID:5884
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
      4⤵
      PID:5676
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
      4⤵
      PID:6540
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertToSplit.crw >nul 2>&1
      4⤵
      PID:4880
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertToSplit.crw" /grant Administrators:F >nul 2>&1
      4⤵
      PID:3236
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
      4⤵
      PID:6764
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4880
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExpandSubmit.DVR-MS >nul 2>&1
      4⤵
      PID:8072
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\ExpandSubmit.DVR-MS" /grant Administrators:F >nul 2>&1
      4⤵
      PID:2564
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\FindUpdate.eps >nul 2>&1
      4⤵
      PID:2964
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\Program Files\FindUpdate.eps" /grant Administrators:F >nul 2>&1
      4⤵
      PID:4732
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Program Files\HideExpand.css >nul 2>&1
      4⤵
      PID:6356
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
    3⤵
    PID:5100
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5008
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
    3⤵
    PID:1352
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4220
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
    3⤵
    PID:5076
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5396
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
    3⤵
    PID:2416
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4996
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
    3⤵
    PID:1172
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
    3⤵
    PID:2964
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f >nul 2>&1
    3⤵
    PID:1064
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5924
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
    3⤵
    PID:4708
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
    3⤵
    PID:2956
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
    3⤵
    PID:6084
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
    3⤵
    PID:1972
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
    3⤵
    PID:2560
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
    3⤵
    - Possible privilege escalation attempt
    PID:5124
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
    3⤵
    PID:4572
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
    3⤵
    PID:3752
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
    3⤵
    PID:468
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
    3⤵
    PID:5920
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
    3⤵
    PID:2660
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4920
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
    3⤵
    PID:6180
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
    3⤵
    PID:2000
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
    3⤵
    PID:6420
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
    3⤵
    - Possible privilege escalation attempt
    PID:772
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertToSplit.crw >nul 2>&1
    3⤵
    PID:6316
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertToSplit.crw" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6968
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
    3⤵
    PID:6684
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
    3⤵
    PID:6188
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExpandSubmit.DVR-MS >nul 2>&1
    3⤵
    PID:2044
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\ExpandSubmit.DVR-MS" /grant Administrators:F >nul 2>&1
    3⤵
    PID:4888
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\FindUpdate.eps >nul 2>&1
    3⤵
    PID:7292
- - C:\Windows\System32\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Program Files\FindUpdate.eps" /grant Administrators:F >nul 2>&1
    3⤵
    PID:7216
- - C:\Windows\System32\takeown.exe
    "C:\Windows\System32\takeown.exe" /f C:\Program Files\HideExpand.css >nul 2>&1
    3⤵
    PID:4956
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\DDF.sys >nul 2>&1
  2⤵
  PID:4460
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\DDF.sys" /grant Administrators:F >nul 2>&1
  2⤵
  PID:2512
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\DumpStack.log.tmp >nul 2>&1
  2⤵
  PID:5268
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\DumpStack.log.tmp" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4360
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\pagefile.sys >nul 2>&1
  2⤵
  PID:2044
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\pagefile.sys" /grant Administrators:F >nul 2>&1
  2⤵
  PID:1200
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\swapfile.sys >nul 2>&1
  2⤵
  PID:2000
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\swapfile.sys" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4572
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini >nul 2>&1
  2⤵
  PID:4748
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini" /grant Administrators:F >nul 2>&1
  2⤵
  PID:1188
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f >nul 2>&1
  2⤵
  PID:5420
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5676
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ApproveRestart.exe >nul 2>&1
  2⤵
  PID:2312
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ApproveRestart.exe" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5664
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertMerge.xhtml >nul 2>&1
  2⤵
  PID:5980
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertMerge.xhtml" /grant Administrators:F >nul 2>&1
  2⤵
  PID:4080
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\AssertUnprotect.dxf >nul 2>&1
  2⤵
  - Modifies file permissions
  PID:4172
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\AssertUnprotect.dxf" /grant Administrators:F >nul 2>&1
  2⤵
  PID:3340
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\BlockMerge.nfo >nul 2>&1
  2⤵
  PID:1112
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\BlockMerge.nfo" /grant Administrators:F >nul 2>&1
  2⤵
  PID:956
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointRestore.mp2 >nul 2>&1
  2⤵
  PID:4112
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointRestore.mp2" /grant Administrators:F >nul 2>&1
  2⤵
  PID:3140
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\CheckpointWait.jpe >nul 2>&1
  2⤵
  PID:7148
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\CheckpointWait.jpe" /grant Administrators:F >nul 2>&1
  2⤵
  PID:5928
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\CompressDisable.ps1xml >nul 2>&1
  2⤵
  PID:6436
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\CompressDisable.ps1xml" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6532
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertRequest.ogg >nul 2>&1
  2⤵
  PID:4088
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertRequest.ogg" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6760
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ConvertToSplit.crw >nul 2>&1
  2⤵
  PID:2396
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ConvertToSplit.crw" /grant Administrators:F >nul 2>&1
  2⤵
  PID:6880
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\desktop.ini >nul 2>&1
  2⤵
  PID:6992
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\desktop.ini" /grant Administrators:F >nul 2>&1
  2⤵
  PID:1456
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\ExpandSubmit.DVR-MS >nul 2>&1
  2⤵
  PID:8064
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\ExpandSubmit.DVR-MS" /grant Administrators:F >nul 2>&1
  2⤵
  PID:7652
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\FindUpdate.eps >nul 2>&1
  2⤵
  PID:8140
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Program Files\FindUpdate.eps" /grant Administrators:F >nul 2>&1
  2⤵
  PID:7020
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Program Files\HideExpand.css >nul 2>&1
  2⤵
  PID:7188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads