wannacry | 1ebc400a4ae535267f557a3699e1f430b0121d7e74a3a352d50e2e0ff7cf915f

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_64353109ab086942c3a5ecd50dc78003_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 182KB
Sample260818-anpbcssfkc
SHA256 1ebc400a4ae535267f557a3699e1f430b0121d7e74a3a352d50e2e0ff7cf915f
MD5 64353109ab086942c3a5ecd50dc78003
SHA1 755ec2fd7c9af54be741d8654137aa6edffe5b2c
SHA512 4743af56afede605508b9a454549926a4bbc8c45159c4d0e204333ec67e5148bb6babec5f007201e8a8e130779ab930f46714da9281d482e31a3d444e0c19b46
SSDEEP 3072:cugUr49SL8Qnbtil+5SWo4Ib2an+U+WPOZ8M:pr4ELzX5Ib2a4
TLSH
T17F048E46B3E500F9E177C13989911A0AF672785607609BEF03A14776EF232E4AD3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution exploit wannacry impact persistence ransomware spyware stealer worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects command variations typically used by ransomware 2 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b867-2.dat	INDICATOR_SUSPICIOUS_GENRansomware
behavioral2/memory/2916-5-0x0000000000AA0000-0x0000000000AAE000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2236	bcdedit.exe
3692	bcdedit.exe

Renames multiple (632) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5064	wbadmin.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	tmp2997.tmp

Disables Task Manager via registry modification
defense_evasion

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
3008	Process not Found
2840	takeown.exe
320	icacls.exe
2652	icacls.exe
4196	icacls.exe
5312	Process not Found
1576	Process not Found
3044	Process not Found
4756	Process not Found
5808	takeown.exe
2504	takeown.exe
204	takeown.exe
4620	Process not Found
5736	Process not Found
2752	Process not Found
5308	Process not Found
1628	takeown.exe
4244	takeown.exe
2280	takeown.exe
2356	takeown.exe
3580	Process not Found
5292	Process not Found
3848	Process not Found
4456	icacls.exe
1272	takeown.exe
1460	icacls.exe
5680	icacls.exe
5792	takeown.exe
816	icacls.exe
2480	icacls.exe
3376	Process not Found
5656	Process not Found
4580	Process not Found
1624	icacls.exe
5312	icacls.exe
4580	takeown.exe
3648	Process not Found
2912	Process not Found
632	icacls.exe
3904	icacls.exe
5488	icacls.exe
2808	icacls.exe
5552	icacls.exe
1764	takeown.exe
5540	Process not Found
5968	Process not Found
312	takeown.exe
728	icacls.exe
5552	icacls.exe
5948	icacls.exe
5804	Process not Found
5880	Process not Found
4312	Process not Found
1032	Process not Found
4632	icacls.exe
2264	icacls.exe
4412	icacls.exe
2360	Process not Found
4144	Process not Found
4880	Process not Found
3008	icacls.exe
1272	Process not Found
5036	takeown.exe
1336	icacls.exe

Deletes itself 1 IoCs

pid	Process
2916	tmp2997.tmp

Executes dropped EXE 2 IoCs

pid	Process
2916	tmp2997.tmp
8	5vwotnzs.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2832	icacls.exe
4564	icacls.exe
3160	takeown.exe
3032	icacls.exe
3408	takeown.exe
1188	takeown.exe
5488	Process not Found
5208	Process not Found
832	icacls.exe
5756	takeown.exe
5736	icacls.exe
5824	takeown.exe
5272	icacls.exe
3764	Process not Found
4756	Process not Found
4196	Process not Found
2568	icacls.exe
6048	takeown.exe
392	icacls.exe
2488	Process not Found
1576	Process not Found
404	Process not Found
2212	Process not Found
5804	Process not Found
324	takeown.exe
948	takeown.exe
2480	takeown.exe
3212	Process not Found
4764	Process not Found
4804	Process not Found
4544	Process not Found
4880	Process not Found
2484	takeown.exe
4928	takeown.exe
2332	takeown.exe
1228	Process not Found
2984	Process not Found
2088	icacls.exe
5724	Process not Found
3804	Process not Found
2360	Process not Found
2184	icacls.exe
416	takeown.exe
6036	takeown.exe
4412	icacls.exe
6044	Process not Found
1124	Process not Found
2320	takeown.exe
4620	icacls.exe
3596	icacls.exe
5736	icacls.exe
2848	icacls.exe
2480	icacls.exe
6036	Process not Found
5656	Process not Found
5688	icacls.exe
4232	takeown.exe
572	icacls.exe
1124	Process not Found
2220	Process not Found
3376	Process not Found
3108	Process not Found
2340	icacls.exe
3824	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateHelper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\5vwotnzs.exe\" --service"	tmp2997.tmp

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_tmp.bmp"	tmp2997.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5948	vssadmin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	tmp2997.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	Process not Found

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2912	wmic.exe
2912	wmic.exe
2912	wmic.exe
2912	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3172	shutdown.exe
Token: SeRemoteShutdownPrivilege	3172	shutdown.exe
Token: SeIncreaseQuotaPrivilege	2912	wmic.exe
Token: SeSecurityPrivilege	2912	wmic.exe
Token: SeTakeOwnershipPrivilege	2912	wmic.exe
Token: SeLoadDriverPrivilege	2912	wmic.exe
Token: SeSystemProfilePrivilege	2912	wmic.exe
Token: SeSystemtimePrivilege	2912	wmic.exe
Token: SeProfSingleProcessPrivilege	2912	wmic.exe
Token: SeIncBasePriorityPrivilege	2912	wmic.exe
Token: SeCreatePagefilePrivilege	2912	wmic.exe
Token: SeBackupPrivilege	2912	wmic.exe
Token: SeRestorePrivilege	2912	wmic.exe
Token: SeShutdownPrivilege	2912	wmic.exe
Token: SeDebugPrivilege	2912	wmic.exe
Token: SeSystemEnvironmentPrivilege	2912	wmic.exe
Token: SeRemoteShutdownPrivilege	2912	wmic.exe
Token: SeUndockPrivilege	2912	wmic.exe
Token: SeManageVolumePrivilege	2912	wmic.exe
Token: 33	2912	wmic.exe
Token: 34	2912	wmic.exe
Token: 35	2912	wmic.exe
Token: 36	2912	wmic.exe
Token: SeBackupPrivilege	372	vssvc.exe
Token: SeRestorePrivilege	372	vssvc.exe
Token: SeAuditPrivilege	372	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2912	wmic.exe
Token: SeSecurityPrivilege	2912	wmic.exe
Token: SeTakeOwnershipPrivilege	2912	wmic.exe
Token: SeLoadDriverPrivilege	2912	wmic.exe
Token: SeSystemProfilePrivilege	2912	wmic.exe
Token: SeSystemtimePrivilege	2912	wmic.exe
Token: SeProfSingleProcessPrivilege	2912	wmic.exe
Token: SeIncBasePriorityPrivilege	2912	wmic.exe
Token: SeCreatePagefilePrivilege	2912	wmic.exe
Token: SeBackupPrivilege	2912	wmic.exe
Token: SeRestorePrivilege	2912	wmic.exe
Token: SeShutdownPrivilege	2912	wmic.exe
Token: SeDebugPrivilege	2912	wmic.exe
Token: SeSystemEnvironmentPrivilege	2912	wmic.exe
Token: SeRemoteShutdownPrivilege	2912	wmic.exe
Token: SeUndockPrivilege	2912	wmic.exe
Token: SeManageVolumePrivilege	2912	wmic.exe
Token: 33	2912	wmic.exe
Token: 34	2912	wmic.exe
Token: 35	2912	wmic.exe
Token: 36	2912	wmic.exe
Token: SeBackupPrivilege	4872	wbengine.exe
Token: SeRestorePrivilege	4872	wbengine.exe
Token: SeSecurityPrivilege	4872	wbengine.exe
Token: SeTakeOwnershipPrivilege	3608	takeown.exe
Token: SeTakeOwnershipPrivilege	3304	takeown.exe
Token: SeTakeOwnershipPrivilege	5800	takeown.exe
Token: SeTakeOwnershipPrivilege	416	takeown.exe
Token: SeTakeOwnershipPrivilege	2972	takeown.exe
Token: SeTakeOwnershipPrivilege	2320	takeown.exe
Token: SeTakeOwnershipPrivilege	6024	takeown.exe
Token: SeTakeOwnershipPrivilege	3888	takeown.exe
Token: SeTakeOwnershipPrivilege	5304	takeown.exe
Token: SeTakeOwnershipPrivilege	5724	takeown.exe
Token: SeTakeOwnershipPrivilege	5824	takeown.exe
Token: SeTakeOwnershipPrivilege	4232	takeown.exe
Token: SeTakeOwnershipPrivilege	1544	takeown.exe
Token: SeTakeOwnershipPrivilege	2760	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3476	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 2916	360	2026-08-17_64353109ab086942c3a5ecd50dc78003_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 2916 wrote to memory of 8	2916	tmp2997.tmp	90
PID 2916 wrote to memory of 3172	2916	tmp2997.tmp	91
PID 2916 wrote to memory of 5948	2916	tmp2997.tmp	92
PID 2916 wrote to memory of 2912	2916	tmp2997.tmp	210
PID 2916 wrote to memory of 3692	2916	tmp2997.tmp	94
PID 2916 wrote to memory of 2236	2916	tmp2997.tmp	95
PID 2916 wrote to memory of 5064	2916	tmp2997.tmp	96
PID 2916 wrote to memory of 6120	2916	tmp2997.tmp	103
PID 2916 wrote to memory of 2884	2916	tmp2997.tmp	104
PID 2916 wrote to memory of 3236	2916	tmp2997.tmp	105
PID 2916 wrote to memory of 5480	2916	tmp2997.tmp	110
PID 2916 wrote to memory of 2936	2916	tmp2997.tmp	282
PID 2916 wrote to memory of 832	2916	tmp2997.tmp	114
PID 2916 wrote to memory of 1620	2916	tmp2997.tmp	120
PID 2916 wrote to memory of 4596	2916	tmp2997.tmp	457
PID 2916 wrote to memory of 2432	2916	tmp2997.tmp	508
PID 2916 wrote to memory of 2652	2916	tmp2997.tmp	127
PID 2916 wrote to memory of 1440	2916	tmp2997.tmp	447
PID 2916 wrote to memory of 4160	2916	tmp2997.tmp	131
PID 2916 wrote to memory of 6036	2916	tmp2997.tmp	512
PID 2916 wrote to memory of 1544	2916	tmp2997.tmp	473
PID 2916 wrote to memory of 4376	2916	tmp2997.tmp	137
PID 2916 wrote to memory of 3608	2916	tmp2997.tmp	395
PID 2916 wrote to memory of 4756	2916	tmp2997.tmp	222
PID 2916 wrote to memory of 3580	2916	tmp2997.tmp	475
PID 2916 wrote to memory of 2660	2916	tmp2997.tmp	145
PID 2916 wrote to memory of 1572	2916	tmp2997.tmp	391
PID 2916 wrote to memory of 464	2916	tmp2997.tmp	149
PID 2916 wrote to memory of 5952	2916	tmp2997.tmp	617
PID 2916 wrote to memory of 5932	2916	tmp2997.tmp	154
PID 2916 wrote to memory of 2984	2916	tmp2997.tmp	704
PID 2916 wrote to memory of 3304	2916	tmp2997.tmp	740
PID 2916 wrote to memory of 6040	2916	tmp2997.tmp	159
PID 2916 wrote to memory of 5504	2916	tmp2997.tmp	570
PID 2916 wrote to memory of 5520	2916	tmp2997.tmp	405
PID 2916 wrote to memory of 2052	2916	tmp2997.tmp	650
PID 2916 wrote to memory of 2184	2916	tmp2997.tmp	829
PID 2916 wrote to memory of 2264	2916	tmp2997.tmp	887
PID 2916 wrote to memory of 3464	2916	tmp2997.tmp	656
PID 2916 wrote to memory of 5108	2916	tmp2997.tmp	173
PID 2916 wrote to memory of 4084	2916	tmp2997.tmp	174
PID 2916 wrote to memory of 3880	2916	tmp2997.tmp	657
PID 2916 wrote to memory of 2568	2916	tmp2997.tmp	579
PID 2916 wrote to memory of 5800	2916	tmp2997.tmp	917
PID 2916 wrote to memory of 3408	2916	tmp2997.tmp	185
PID 2916 wrote to memory of 6000	2916	tmp2997.tmp	186
PID 2916 wrote to memory of 1948	2916	tmp2997.tmp	187
PID 2916 wrote to memory of 400	2916	tmp2997.tmp	998
PID 2916 wrote to memory of 4964	2916	tmp2997.tmp	737
PID 2916 wrote to memory of 728	2916	tmp2997.tmp	923
PID 2916 wrote to memory of 2448	2916	tmp2997.tmp	1009
PID 2916 wrote to memory of 4284	2916	tmp2997.tmp	942
PID 2916 wrote to memory of 1176	2916	tmp2997.tmp	616
PID 2916 wrote to memory of 4596	2916	tmp2997.tmp	1090
PID 2916 wrote to memory of 4232	2916	tmp2997.tmp	798
PID 2916 wrote to memory of 416	2916	tmp2997.tmp	855
PID 2916 wrote to memory of 1516	2916	tmp2997.tmp	939
PID 2916 wrote to memory of 1440	2916	tmp2997.tmp	785
PID 2916 wrote to memory of 3804	2916	tmp2997.tmp	213
PID 2916 wrote to memory of 3400	2916	tmp2997.tmp	1174
PID 2916 wrote to memory of 2340	2916	tmp2997.tmp	462
PID 2916 wrote to memory of 2972	2916	tmp2997.tmp	944
PID 2916 wrote to memory of 4248	2916	tmp2997.tmp	1117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-17_64353109ab086942c3a5ecd50dc78003_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_64353109ab086942c3a5ecd50dc78003_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:360
- C:\Users\Admin\AppData\Local\Temp\tmp2997.tmp
  "C:\Users\Admin\AppData\Local\Temp\tmp2997.tmp"
  2⤵
  - Disables RegEdit via registry modification
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\5vwotnzs.exe
    "C:\Users\Admin\AppData\Local\Temp\5vwotnzs.exe" --service
    3⤵
    - Executes dropped EXE
    PID:8
- - C:\Windows\SYSTEM32\shutdown.exe
    "shutdown" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\SYSTEM32\vssadmin.exe
    "vssadmin" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5948
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" shadowcopy delete
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3692
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2236
- - C:\Windows\SYSTEM32\wbadmin.exe
    "wbadmin" delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:5064
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRead.msi" /a
    3⤵
    PID:6120
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\NTUSER.DAT" /a
    3⤵
    PID:2884
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\ClickToRun\ProductReleases\E9EB0BA7-8B96-4EF6-A09C-165A576268C6\mergedVirtualRegistry.dat" /a
    3⤵
    PID:3236
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRead.msi" /grant Administrators:F /t
    3⤵
    PID:5480
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\NTUSER.DAT" /grant Administrators:F /t
    3⤵
    PID:2936
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\ClickToRun\ProductReleases\E9EB0BA7-8B96-4EF6-A09C-165A576268C6\mergedVirtualRegistry.dat" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:832
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe" /a
    3⤵
    PID:1620
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe" /a
    3⤵
    PID:4596
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\ClickToRun\ProductReleases\E9EB0BA7-8B96-4EF6-A09C-165A576268C6\en-us.16\stream.x64.en-us.man.dat" /a
    3⤵
    PID:2432
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe" /grant Administrators:F /t
    3⤵
    PID:2652
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat" /a
    3⤵
    PID:1440
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe" /grant Administrators:F /t
    3⤵
    PID:4160
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\ClickToRun\ProductReleases\E9EB0BA7-8B96-4EF6-A09C-165A576268C6\en-us.16\stream.x64.en-us.man.dat" /grant Administrators:F /t
    3⤵
    PID:6036
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi" /a
    3⤵
    PID:1544
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat" /grant Administrators:F /t
    3⤵
    PID:4376
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\E9EB0BA7-8B96-4EF6-A09C-165A576268C6\en-us.16\stream.x64.en-us.man.dat" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3608
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi" /grant Administrators:F /t
    3⤵
    PID:4756
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\ClickToRun\ProductReleases\E9EB0BA7-8B96-4EF6-A09C-165A576268C6\x-none.16\stream.x64.x-none.man.dat" /a
    3⤵
    PID:3580
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin" /a
    3⤵
    PID:2660
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\E9EB0BA7-8B96-4EF6-A09C-165A576268C6\en-us.16\stream.x64.en-us.man.dat" /grant Administrators:F /t
    3⤵
    PID:1572
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\ClickToRun\ProductReleases\E9EB0BA7-8B96-4EF6-A09C-165A576268C6\x-none.16\stream.x64.x-none.man.dat" /grant Administrators:F /t
    3⤵
    PID:464
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}v64.60.31203\windowsdesktop-runtime-8.0.15-win-x64.msi" /a
    3⤵
    PID:5952
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}v64.60.31149\dotnet-hostfxr-8.0.15-win-x64.msi" /a
    3⤵
    PID:5932
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin" /grant Administrators:F /t
    3⤵
    PID:2984
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\E9EB0BA7-8B96-4EF6-A09C-165A576268C6\x-none.16\stream.x64.x-none.man.dat" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}v64.60.31203\windowsdesktop-runtime-8.0.15-win-x64.msi" /grant Administrators:F /t
    3⤵
    PID:6040
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe" /a
    3⤵
    PID:5504
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}v64.60.31149\dotnet-hostfxr-8.0.15-win-x64.msi" /grant Administrators:F /t
    3⤵
    PID:5520
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\E9EB0BA7-8B96-4EF6-A09C-165A576268C6\x-none.16\stream.x64.x-none.man.dat" /grant Administrators:F /t
    3⤵
    PID:2052
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat" /a
    3⤵
    PID:2184
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe" /grant Administrators:F /t
    3⤵
    PID:2264
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Desktop\ExpandTrace.wav" /a
    3⤵
    PID:3464
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /a
    3⤵
    PID:5108
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe" /a
    3⤵
    PID:4084
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi" /a
    3⤵
    PID:3880
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:2568
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi" /grant Administrators:F /t
    3⤵
    PID:3408
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Desktop\ExpandTrace.wav" /grant Administrators:F /t
    3⤵
    PID:6000
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe" /grant Administrators:F /t
    3⤵
    PID:1948
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /grant Administrators:F /t
    3⤵
    PID:400
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico" /a
    3⤵
    PID:4964
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /grant Administrators:F /t
    3⤵
    PID:728
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /a
    3⤵
    PID:2448
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Desktop\HideInvoke.mov" /a
    3⤵
    PID:4284
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi" /a
    3⤵
    PID:1176
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico" /grant Administrators:F /t
    3⤵
    PID:4596
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}v48.108.8828\dotnet-host-6.0.27-win-x64.msi" /a
    3⤵
    PID:4232
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /grant Administrators:F /t
    3⤵
    PID:1516
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2912
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi" /grant Administrators:F /t
    3⤵
    PID:1440
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}v48.108.8828\dotnet-host-6.0.27-win-x64.msi" /grant Administrators:F /t
    3⤵
    PID:3804
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /grant Administrators:F /t
    3⤵
    PID:3400
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Desktop\HideInvoke.mov" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:2340
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat" /a
    3⤵
    PID:4248
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4756
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /a
    3⤵
    PID:5088
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /grant Administrators:F /t
    3⤵
    PID:6084
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\dotnet-host-8.0.15-win-x64.msi" /a
    3⤵
    PID:5440
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat" /grant Administrators:F /t
    3⤵
    PID:3748
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /a
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Desktop\ImportSwitch.tiff" /a
    3⤵
    - Possible privilege escalation attempt
    PID:5036
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /grant Administrators:F /t
    3⤵
    PID:1296
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\dotnet-host-8.0.15-win-x64.msi" /grant Administrators:F /t
    3⤵
    PID:3484
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6024
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /grant Administrators:F /t
    3⤵
    PID:3980
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat" /a
    3⤵
    PID:3304
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Desktop\ImportSwitch.tiff" /grant Administrators:F /t
    3⤵
    PID:2688
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" /a
    3⤵
    PID:944
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /grant Administrators:F /t
    3⤵
    PID:2572
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi" /a
    3⤵
    PID:4824
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat" /grant Administrators:F /t
    3⤵
    PID:2724
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Desktop\LimitMeasure.xlsx" /a
    3⤵
    PID:2508
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" /grant Administrators:F /t
    3⤵
    PID:1316
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5304
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi" /grant Administrators:F /t
    3⤵
    PID:3344
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /grant Administrators:F /t
    3⤵
    PID:5808
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Desktop\LimitMeasure.xlsx" /grant Administrators:F /t
    3⤵
    PID:5200
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico" /a
    3⤵
    - Modifies file permissions
    PID:324
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /grant Administrators:F /t
    3⤵
    PID:5548
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /a
    3⤵
    PID:1332
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /a
    3⤵
    PID:908
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5724
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5824
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /grant Administrators:F /t
    3⤵
    PID:5968
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico" /grant Administrators:F /t
    3⤵
    PID:2936
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Desktop\RequestNew.xlsx" /a
    3⤵
    PID:3596
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /grant Administrators:F /t
    3⤵
    PID:3660
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /grant Administrators:F /t
    3⤵
    PID:2648
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /grant Administrators:F /t
    3⤵
    PID:6100
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Desktop\RequestNew.xlsx" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:632
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi" /a
    3⤵
    PID:1344
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\128.png" /a
    3⤵
    PID:5736
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Desktop\ResetSubmit.jpeg" /a
    3⤵
    PID:6112
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi" /a
    3⤵
    PID:5652
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /grant Administrators:F /t
    3⤵
    PID:3048
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi" /grant Administrators:F /t
    3⤵
    PID:1896
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\128.png" /grant Administrators:F /t
    3⤵
    PID:3380
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Desktop\ResetSubmit.jpeg" /grant Administrators:F /t
    3⤵
    PID:4760
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /grant Administrators:F /t
    3⤵
    PID:3040
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi" /grant Administrators:F /t
    3⤵
    PID:6084
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico" /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico" /a
    3⤵
    PID:6044
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico" /grant Administrators:F /t
    3⤵
    PID:3644
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:1624
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Desktop\SearchGroup.xlsx" /a
    3⤵
    PID:4500
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi" /a
    3⤵
    PID:5504
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt" /a
    3⤵
    PID:5648
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}v48.108.8828\dotnet-hostfxr-6.0.27-win-x64.msi" /a
    3⤵
    PID:3508
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico" /a
    3⤵
    PID:6048
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Desktop\SearchGroup.xlsx" /grant Administrators:F /t
    3⤵
    PID:1764
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi" /grant Administrators:F /t
    3⤵
    PID:2012
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt" /grant Administrators:F /t
    3⤵
    PID:3008
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}v48.108.8828\dotnet-hostfxr-6.0.27-win-x64.msi" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:2184
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico" /a
    3⤵
    - Possible privilege escalation attempt
    PID:2840
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico" /grant Administrators:F /t
    3⤵
    PID:5292
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico" /grant Administrators:F /t
    3⤵
    PID:1032
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Desktop\WaitExit.xlsx" /a
    3⤵
    PID:2276
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMDATA64.DAT" /a
    3⤵
    PID:2480
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico" /a
    3⤵
    PID:1332
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}v64.60.31149\dotnet-runtime-8.0.15-win-x64.msi" /a
    3⤵
    - Modifies file permissions
    PID:3824
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico" /a
    3⤵
    PID:4536
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Desktop\WaitExit.xlsx" /grant Administrators:F /t
    3⤵
    PID:2912
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMDATA64.DAT" /grant Administrators:F /t
    3⤵
    PID:5028
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico" /grant Administrators:F /t
    3⤵
    PID:1912
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico" /grant Administrators:F /t
    3⤵
    PID:3452
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}v64.60.31149\dotnet-runtime-8.0.15-win-x64.msi" /grant Administrators:F /t
    3⤵
    PID:3164
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico" /a
    3⤵
    PID:2936
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico" /a
    3⤵
    PID:4684
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /a
    3⤵
    PID:6100
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi" /a
    3⤵
    PID:2592
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Documents\CompleteRequest.docx" /a
    3⤵
    PID:2832
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico" /grant Administrators:F /t
    3⤵
    PID:4564
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico" /grant Administrators:F /t
    3⤵
    PID:4616
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /grant Administrators:F /t
    3⤵
    PID:3648
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi" /grant Administrators:F /t
    3⤵
    PID:3904
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Documents\CompleteRequest.docx" /grant Administrators:F /t
    3⤵
    PID:1108
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico" /a
    3⤵
    PID:1572
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico" /a
    3⤵
    PID:6112
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5036
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt" /a
    3⤵
    PID:3608
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi" /a
    3⤵
    PID:3748
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Documents\DisableEnable.txt" /a
    3⤵
    PID:2904
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico" /grant Administrators:F /t
    3⤵
    PID:3324
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico" /grant Administrators:F /t
    3⤵
    PID:2476
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{9F51D16B-42E8-4A4A-8228-75045541A2AE}v56.64.8781\dotnet-host-7.0.16-win-x64.msi" /a
    3⤵
    PID:5520
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt" /grant Administrators:F /t
    3⤵
    PID:5060
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi" /grant Administrators:F /t
    3⤵
    PID:1204
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Documents\DisableEnable.txt" /grant Administrators:F /t
    3⤵
    PID:3304
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico" /a
    3⤵
    - Modifies file permissions
    PID:948
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico" /a
    3⤵
    PID:308
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{9F51D16B-42E8-4A4A-8228-75045541A2AE}v56.64.8781\dotnet-host-7.0.16-win-x64.msi" /grant Administrators:F /t
    3⤵
    PID:2964
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico" /grant Administrators:F /t
    3⤵
    PID:4944
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico" /grant Administrators:F /t
    3⤵
    PID:2012
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT" /a
    3⤵
    PID:3172
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /a
    3⤵
    PID:4580
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi" /a
    3⤵
    - Possible privilege escalation attempt
    PID:312
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Documents\GrantExit.docx" /a
    3⤵
    PID:1428
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT" /grant Administrators:F /t
    3⤵
    PID:5552
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico" /a
    3⤵
    PID:5808
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico" /a
    3⤵
    PID:204
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:1336
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi" /grant Administrators:F /t
    3⤵
    PID:1768
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Documents\GrantExit.docx" /grant Administrators:F /t
    3⤵
    PID:2344
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico" /grant Administrators:F /t
    3⤵
    PID:3824
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico" /grant Administrators:F /t
    3⤵
    PID:5968
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /a
    3⤵
    PID:1440
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico" /a
    3⤵
    PID:4284
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico" /a
    3⤵
    PID:3232
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Documents\InvokeLock.docx" /a
    3⤵
    PID:1960
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi" /a
    3⤵
    PID:3224
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4596
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi" /a
    3⤵
    PID:5864
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /grant Administrators:F /t
    3⤵
    PID:3848
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico" /grant Administrators:F /t
    3⤵
    PID:5284
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2340
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico" /grant Administrators:F /t
    3⤵
    PID:2992
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi" /grant Administrators:F /t
    3⤵
    PID:4260
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Documents\InvokeLock.docx" /grant Administrators:F /t
    3⤵
    PID:2788
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi" /grant Administrators:F /t
    3⤵
    PID:4696
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico" /a
    3⤵
    PID:4180
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe" /a
    3⤵
    PID:1544
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico" /a
    3⤵
    PID:3580
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico" /grant Administrators:F /t
    3⤵
    PID:2848
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Documents\SubmitSkip.docx" /a
    3⤵
    PID:5992
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe" /grant Administrators:F /t
    3⤵
    PID:4760
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\dotnet-runtime-7.0.16-win-x64.msi" /a
    3⤵
    PID:576
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi" /a
    3⤵
    PID:2264
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico" /grant Administrators:F /t
    3⤵
    PID:2088
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Documents\SubmitSkip.docx" /grant Administrators:F /t
    3⤵
    PID:3176
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\dotnet-runtime-7.0.16-win-x64.msi" /grant Administrators:F /t
    3⤵
    PID:3644
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico" /a
    3⤵
    PID:6124
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi" /grant Administrators:F /t
    3⤵
    PID:1872
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico" /a
    3⤵
    PID:5820
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adal.dll" /a
    3⤵
    PID:4824
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Downloads\OutRedo.gif" /a
    3⤵
    PID:2840
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico" /grant Administrators:F /t
    3⤵
    PID:4288
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adal.dll" /grant Administrators:F /t
    3⤵
    PID:4196
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico" /grant Administrators:F /t
    3⤵
    PID:6048
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2432
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Downloads\OutRedo.gif" /grant Administrators:F /t
    3⤵
    PID:1272
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" /a
    3⤵
    PID:1524
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6036
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico" /a
    3⤵
    PID:2280
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" /grant Administrators:F /t
    3⤵
    PID:5028
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico" /a
    3⤵
    PID:2780
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png" /a
    3⤵
    PID:5920
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico" /grant Administrators:F /t
    3⤵
    PID:5636
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Downloads\ResetWatch.gif" /a
    3⤵
    - Possible privilege escalation attempt
    PID:5808
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe" /a
    3⤵
    PID:2912
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi" /a
    3⤵
    PID:1176
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico" /grant Administrators:F /t
    3⤵
    PID:4748
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png" /grant Administrators:F /t
    3⤵
    PID:1516
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Downloads\ResetWatch.gif" /grant Administrators:F /t
    3⤵
    PID:5852
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi" /grant Administrators:F /t
    3⤵
    PID:1016
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe" /grant Administrators:F /t
    3⤵
    PID:2356
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico" /a
    3⤵
    PID:4468
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico" /a
    3⤵
    PID:1108
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-console-l1-1-0.dll" /a
    3⤵
    PID:4412
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Downloads\SendRemove.jpeg" /a
    3⤵
    PID:4864
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:2832
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:4564
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-console-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:2384
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /a
    3⤵
    PID:4636
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{E634F316-BEB6-4FB3-A612-F7102F576165}v48.108.8836\windowsdesktop-runtime-6.0.27-win-x64.msi" /a
    3⤵
    PID:5896
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Downloads\SendRemove.jpeg" /grant Administrators:F /t
    3⤵
    PID:5956
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{E634F316-BEB6-4FB3-A612-F7102F576165}v48.108.8836\windowsdesktop-runtime-6.0.27-win-x64.msi" /grant Administrators:F /t
    3⤵
    PID:3432
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico" /a
    3⤵
    PID:5272
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /grant Administrators:F /t
    3⤵
    PID:1680
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico" /a
    3⤵
    - Possible privilege escalation attempt
    PID:1628
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-datetime-l1-1-0.dll" /a
    3⤵
    PID:3240
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico" /grant Administrators:F /t
    3⤵
    PID:992
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico" /grant Administrators:F /t
    3⤵
    PID:5504
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Downloads\ShowBackup.rtf" /a
    3⤵
    PID:3920
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi" /a
    3⤵
    PID:320
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-datetime-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:832
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico" /a
    3⤵
    PID:2568
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico" /a
    3⤵
    PID:2412
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Downloads\ShowBackup.rtf" /grant Administrators:F /t
    3⤵
    PID:4252
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi" /grant Administrators:F /t
    3⤵
    PID:3692
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:728
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico" /grant Administrators:F /t
    3⤵
    PID:3808
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-debug-l1-1-0.dll" /a
    3⤵
    PID:1256
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Diagnosis\osver.txt" /a
    3⤵
    PID:4580
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-debug-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:4304
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Diagnosis\osver.txt" /grant Administrators:F /t
    3⤵
    PID:204
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-errorhandling-l1-1-0.dll" /a
    3⤵
    PID:1984
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Diagnosis\osver.txt" /a
    3⤵
    PID:5064
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-errorhandling-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:5824
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Diagnosis\parse.dat" /a
    3⤵
    PID:5188
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Downloads\UnlockGroup.7z" /a
    3⤵
    PID:5916
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\DisableWrite.ico" /a
    3⤵
    PID:2484
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Diagnosis\osver.txt" /grant Administrators:F /t
    3⤵
    PID:2328
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-1-0.dll" /a
    3⤵
    - Modifies file permissions
    PID:416
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Diagnosis\parse.dat" /grant Administrators:F /t
    3⤵
    PID:5852
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5952
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Downloads\UnlockGroup.7z" /grant Administrators:F /t
    3⤵
    PID:1176
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\DisableWrite.ico" /grant Administrators:F /t
    3⤵
    PID:3648
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Diagnosis\parse.dat" /a
    3⤵
    PID:2936
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:3904
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Diagnosis\parse.dat" /grant Administrators:F /t
    3⤵
    PID:1124
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\FindReset.mov" /a
    3⤵
    PID:2660
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-2-0.dll" /a
    3⤵
    PID:1296
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3048
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat" /a
    3⤵
    PID:5680
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Downloads\WaitExit.bmp" /a
    3⤵
    PID:2668
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat" /a
    3⤵
    PID:1544
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat" /grant Administrators:F /t
    3⤵
    PID:1236
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\FindReset.mov" /grant Administrators:F /t
    3⤵
    PID:3580
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-2-0.dll" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:5688
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Downloads\WaitExit.bmp" /grant Administrators:F /t
    3⤵
    PID:4200
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:5488
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\User Account Pictures\Admin.dat" /a
    3⤵
    PID:4760
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\User Account Pictures\Admin.dat" /a
    3⤵
    PID:5272
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2052
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l2-1-0.dll" /a
    3⤵
    PID:4500
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\User Account Pictures\Admin.dat" /grant Administrators:F /t
    3⤵
    PID:2964
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\User Account Pictures\Admin.dat" /grant Administrators:F /t
    3⤵
    PID:5800
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3880
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l2-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:3464
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\User Account Pictures\guest.bmp" /a
    3⤵
    PID:3644
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Music\BackupUnlock.jpg" /a
    3⤵
    PID:5820
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\InstallConvertFrom.jpeg" /a
    3⤵
    PID:5940
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\User Account Pictures\guest.bmp" /a
    3⤵
    PID:5756
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\User Account Pictures\guest.bmp" /grant Administrators:F /t
    3⤵
    PID:3132
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\InstallConvertFrom.jpeg" /grant Administrators:F /t
    3⤵
    PID:3960
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-handle-l1-1-0.dll" /a
    3⤵
    PID:4312
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Music\BackupUnlock.jpg" /grant Administrators:F /t
    3⤵
    PID:5540
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\User Account Pictures\guest.bmp" /grant Administrators:F /t
    3⤵
    PID:2220
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-handle-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:1336
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\User Account Pictures\guest.png" /a
    3⤵
    PID:6076
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Music\ConvertSelect.bmp" /a
    3⤵
    PID:3452
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\User Account Pictures\guest.png" /a
    3⤵
    PID:1984
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\MergeRedo.bmp" /a
    3⤵
    PID:3660
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-heap-l1-1-0.dll" /a
    3⤵
    - Modifies file permissions
    PID:3160
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\User Account Pictures\guest.png" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:4632
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5808
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Music\ConvertSelect.bmp" /grant Administrators:F /t
    3⤵
    PID:2640
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\MergeRedo.bmp" /grant Administrators:F /t
    3⤵
    PID:1188
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\User Account Pictures\guest.png" /grant Administrators:F /t
    3⤵
    PID:632
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-heap-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:864
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\User Account Pictures\user-192.png" /a
    3⤵
    PID:2328
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\User Account Pictures\user-192.png" /a
    3⤵
    PID:5592
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\User Account Pictures\user-192.png" /grant Administrators:F /t
    3⤵
    PID:4620
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2984
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Music\ConvertToCompress.mov" /a
    3⤵
    PID:1960
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-interlocked-l1-1-0.dll" /a
    3⤵
    PID:5284
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\User Account Pictures\user-192.png" /grant Administrators:F /t
    3⤵
    PID:2884
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Music\ConvertToCompress.mov" /grant Administrators:F /t
    3⤵
    PID:3916
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\AssertImport\BackupDisconnect.zip" /a
    3⤵
    PID:4832
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\User Account Pictures\user-32.png" /a
    3⤵
    PID:1108
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-interlocked-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:2260
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\User Account Pictures\user-32.png" /a
    3⤵
    PID:2900
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\User Account Pictures\user-32.png" /grant Administrators:F /t
    3⤵
    PID:6044
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\AssertImport\BackupDisconnect.zip" /grant Administrators:F /t
    3⤵
    PID:3432
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Music\StartUnpublish.ico" /a
    3⤵
    PID:2668
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-libraryloader-l1-1-0.dll" /a
    3⤵
    PID:1544
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\User Account Pictures\user-32.png" /grant Administrators:F /t
    3⤵
    PID:5956
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\User Account Pictures\user-40.png" /a
    3⤵
    PID:5848
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Music\StartUnpublish.ico" /grant Administrators:F /t
    3⤵
    PID:2032
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-libraryloader-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:5308
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\User Account Pictures\user-40.png" /a
    3⤵
    PID:5748
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4964
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\AssertImport\CloseGroup.dll" /a
    3⤵
    PID:5980
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3304
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\User Account Pictures\user-40.png" /grant Administrators:F /t
    3⤵
    PID:2184
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\User Account Pictures\user-40.png" /grant Administrators:F /t
    3⤵
    PID:5432
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Music\TestExport.ico" /a
    3⤵
    PID:3124
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\AssertImport\CloseGroup.dll" /grant Administrators:F /t
    3⤵
    PID:400
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Music\TestExport.ico" /grant Administrators:F /t
    3⤵
    PID:1524
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\User Account Pictures\user-48.png" /a
    3⤵
    - Modifies file permissions
    PID:2480
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-localization-l1-2-0.dll" /a
    3⤵
    - Modifies file permissions
    PID:5756
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\User Account Pictures\user-48.png" /a
    3⤵
    PID:324
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\User Account Pictures\user-48.png" /grant Administrators:F /t
    3⤵
    PID:3384
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\User Account Pictures\user-48.png" /grant Administrators:F /t
    3⤵
    PID:5296
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\AssertImport\ConvertToUpdate.gif" /a
    3⤵
    PID:2828
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-localization-l1-2-0.dll" /grant Administrators:F /t
    3⤵
    PID:2648
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Music\WriteMount.gif" /a
    3⤵
    PID:2928
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\User Account Pictures\user.bmp" /a
    3⤵
    PID:804
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\User Account Pictures\user.bmp" /a
    3⤵
    PID:2700
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\AssertImport\ConvertToUpdate.gif" /grant Administrators:F /t
    3⤵
    PID:1496
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Music\WriteMount.gif" /grant Administrators:F /t
    3⤵
    PID:3452
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\User Account Pictures\user.bmp" /grant Administrators:F /t
    3⤵
    PID:5380
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\User Account Pictures\user.bmp" /grant Administrators:F /t
    3⤵
    PID:4116
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5916
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-memory-l1-1-0.dll" /a
    3⤵
    PID:5312
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2640
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\AssertImport\ExitRegister.txt" /a
    3⤵
    PID:5952
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Pictures\BlockWrite.jpg" /a
    3⤵
    PID:3288
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\User Account Pictures\user.png" /a
    3⤵
    PID:1440
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3224
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-memory-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:5592
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Pictures\BlockWrite.jpg" /grant Administrators:F /t
    3⤵
    PID:4152
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\User Account Pictures\user.png" /grant Administrators:F /t
    3⤵
    PID:4616
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\AssertImport\ExitRegister.txt" /grant Administrators:F /t
    3⤵
    PID:2808
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\User Account Pictures\user.png" /a
    3⤵
    PID:1660
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\User Account Pictures\user.png" /grant Administrators:F /t
    3⤵
    PID:2884
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-namedpipe-l1-1-0.dll" /a
    3⤵
    - Modifies file permissions
    PID:4232
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\AssertImport\FindAssert.mp3" /a
    3⤵
    PID:4200
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Pictures\DebugExit.gif" /a
    3⤵
    PID:940
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-namedpipe-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:1936
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:4220
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:944
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:1740
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Pictures\DebugExit.gif" /grant Administrators:F /t
    3⤵
    PID:308
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\AssertImport\FindAssert.mp3" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:2088
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5804
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5060
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processenvironment-l1-1-0.dll" /a
    3⤵
    - Possible privilege escalation attempt
    PID:2504
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:336
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\AssertImport\MoveDismount.mp3" /a
    3⤵
    PID:3304
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:1836
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Pictures\ImportRestart.png" /a
    3⤵
    PID:3052
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processenvironment-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:6124
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2184
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5272
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\AssertImport\MoveDismount.mp3" /grant Administrators:F /t
    3⤵
    PID:3132
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:4160
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Pictures\ImportRestart.png" /grant Administrators:F /t
    3⤵
    PID:5572
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:5820
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-0.dll" /a
    3⤵
    PID:5756
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\AssertImport\SetComplete.jpeg" /a
    3⤵
    PID:2404
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2216
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:4212
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:4472
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Pictures\InitializeClose.jpeg" /a
    3⤵
    PID:3444
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\AssertImport\SetComplete.jpeg" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:3032
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:416
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:1568
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-1.dll" /a
    3⤵
    PID:2592
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Pictures\InitializeClose.jpeg" /grant Administrators:F /t
    3⤵
    PID:3448
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    - Possible privilege escalation attempt
    PID:4244
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5736
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-1.dll" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:4620
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\AssertImport\StopGrant.mp4" /a
    3⤵
    PID:5868
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Pictures\OutExport.tiff" /a
    3⤵
    PID:2992
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:4260
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:332
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\AssertImport\StopGrant.mp4" /grant Administrators:F /t
    3⤵
    PID:5172
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Pictures\OutExport.tiff" /grant Administrators:F /t
    3⤵
    PID:6112
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-profile-l1-1-0.dll" /a
    3⤵
    PID:2808
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2260
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1124
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-profile-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:2264
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:1460
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AccountsControl_10.0.26100.1_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:1936
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Pictures\ResizeDeny.png" /a
    3⤵
    PID:1544
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\CompleteExpand\UnregisterSet.docx" /a
    3⤵
    PID:1892
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.AccountsControl_10.0.26100.1_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2088
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AccountsControl_10.0.26100.1_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:4628
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Pictures\ResizeDeny.png" /grant Administrators:F /t
    3⤵
    PID:308
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-rtlsupport-l1-1-0.dll" /a
    3⤵
    PID:992
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\CompleteExpand\UnregisterSet.docx" /grant Administrators:F /t
    3⤵
    PID:2412
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AsyncTextService_10.0.26100.1_neutral__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:4288
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.AccountsControl_10.0.26100.1_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1316
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-rtlsupport-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:1228
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.AsyncTextService_10.0.26100.1_neutral__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:6048
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AsyncTextService_10.0.26100.1_neutral__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:4944
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\EditNew\BackupCompare.rar" /a
    3⤵
    PID:5800
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Pictures\StopAdd.bmp" /a
    3⤵
    PID:1836
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.AsyncTextService_10.0.26100.1_neutral__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3376
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-string-l1-1-0.dll" /a
    3⤵
    PID:5984
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BioEnrollment_10.0.19587.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:728
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Pictures\StopAdd.bmp" /grant Administrators:F /t
    3⤵
    PID:968
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\EditNew\BackupCompare.rar" /grant Administrators:F /t
    3⤵
    PID:5820
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.BioEnrollment_10.0.19587.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:4928
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-string-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:2472
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BioEnrollment_10.0.19587.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5760
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.BioEnrollment_10.0.19587.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3444
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1516
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Pictures\StopPing.bmp" /a
    3⤵
    PID:4248
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4284
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\EditNew\CheckpointJoin.odt" /a
    3⤵
    PID:6024
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.CredDialogHost_10.0.19595.1001_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:5072
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2972
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-1-0.dll" /a
    3⤵
    PID:3108
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.CredDialogHost_10.0.19595.1001_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:4880
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.CredDialogHost_10.0.19595.1001_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3904
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Pictures\StopPing.bmp" /grant Administrators:F /t
    3⤵
    PID:4400
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\EditNew\CheckpointJoin.odt" /grant Administrators:F /t
    3⤵
    PID:3648
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:5856
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.CredDialogHost_10.0.19595.1001_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:5680
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ECApp_10.0.26100.1150_neutral__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:4804
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ECApp_10.0.26100.1150_neutral__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5868
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.ECApp_10.0.26100.1150_neutral__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:4620
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\EditNew\OutUnregister.jpg" /a
    3⤵
    PID:3328
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-2-0.dll" /a
    3⤵
    PID:316
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Pictures\SuspendExpand.tiff" /a
    3⤵
    PID:6044
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:2848
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.ECApp_10.0.26100.1150_neutral__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2036
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\EditNew\OutUnregister.jpg" /grant Administrators:F /t
    3⤵
    PID:3980
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Pictures\SuspendExpand.tiff" /grant Administrators:F /t
    3⤵
    PID:1204
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-2-0.dll" /grant Administrators:F /t
    3⤵
    PID:4816
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3888
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\EditNew\UnregisterOptimize.rtf" /a
    3⤵
    PID:1872
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:4528
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.LockApp_10.0.26100.1301_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:908
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:312
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\EditNew\UnregisterOptimize.rtf" /grant Administrators:F /t
    3⤵
    PID:832
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2012
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.LockApp_10.0.26100.1301_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1892
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-sysinfo-l1-1-0.dll" /a
    3⤵
    PID:4840
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\Pictures\xboGFgSr.jpg" /a
    3⤵
    PID:3132
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:400
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.LockApp_10.0.26100.1301_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3292
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\Pictures\xboGFgSr.jpg" /grant Administrators:F /t
    3⤵
    PID:2652
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-sysinfo-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:2480
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    - Possible privilege escalation attempt
    PID:5792
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat" /a
    3⤵
    PID:2928
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2448
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.LockApp_10.0.26100.1301_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5064
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:4288
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-timezone-l1-1-0.dll" /a
    3⤵
    PID:3596
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat" /grant Administrators:F /t
    3⤵
    PID:4456
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    - Modifies file permissions
    PID:2484
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    - Modifies file permissions
    PID:4928
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\startupCache\scriptCache-child-current.bin" /a
    3⤵
    PID:3684
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-timezone-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:4116
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1344
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:5312
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\startupCache\scriptCache-child-current.bin" /grant Administrators:F /t
    3⤵
    PID:6116
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat" /a
    3⤵
    PID:1896
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-util-l1-1-0.dll" /a
    3⤵
    PID:2472
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.CBS_9.2311.10002.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:2824
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:5992
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat" /grant Administrators:F /t
    3⤵
    PID:2984
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-util-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:4804
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2976
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.CBS_9.2311.10002.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1624
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\startupCache\scriptCache-current.bin" /a
    3⤵
    PID:5108
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx" /a
    3⤵
    PID:5204
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3176
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\startupCache\scriptCache-current.bin" /grant Administrators:F /t
    3⤵
    PID:1628
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.CBS_9.2311.10002.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:2884
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Win32WebViewHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:4964
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-conio-l1-1-0.dll" /a
    3⤵
    PID:1764
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx" /grant Administrators:F /t
    3⤵
    PID:2132
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.CBS_9.2311.10002.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1544
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3980
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Win32WebViewHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:6044
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-conio-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:320
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\m8dw8qb9.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.bin" /a
    3⤵
    - Modifies file permissions
    PID:6036
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Win32WebViewHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:404
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3960
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\startupCache\urlCache-current.bin" /a
    3⤵
    PID:1256
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2508
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\m8dw8qb9.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.bin" /grant Administrators:F /t
    3⤵
    PID:5060
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Win32WebViewHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3052
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-convert-l1-1-0.dll" /a
    3⤵
    PID:5292
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\startupCache\urlCache-current.bin" /grant Administrators:F /t
    3⤵
    PID:2828
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:324
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AssignedAccessLockApp_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    - Possible privilege escalation attempt
    PID:4580
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5548
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:4136
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\AlternateServices.bin" /a
    3⤵
    PID:3292
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4596
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AssignedAccessLockApp_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3376
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-convert-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:3384
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:6076
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\AlternateServices.bin" /grant Administrators:F /t
    3⤵
    PID:1768
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AugLoop.CBS_1.572.2254.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:4928
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\pkcs11.txt" /a
    3⤵
    PID:5316
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AssignedAccessLockApp_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2356
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-environment-l1-1-0.dll" /a
    3⤵
    PID:4864
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6024
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AugLoop.CBS_1.572.2254.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:572
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\pkcs11.txt" /grant Administrators:F /t
    3⤵
    PID:3648
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AssignedAccessLockApp_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2320
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-environment-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:3684
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\SiteSecurityServiceState.bin" /a
    3⤵
    PID:5656
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4248
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19580.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2832
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AugLoop.CBS_1.572.2254.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:3108
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AugLoop.CBS_1.572.2254.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2688
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19580.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3040
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-filesystem-l1-1-0.dll" /a
    3⤵
    PID:4564
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\SiteSecurityServiceState.bin" /grant Administrators:F /t
    3⤵
    PID:5172
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3880
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19580.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2784
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-filesystem-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:1108
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6084
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.bin" /a
    3⤵
    PID:1236
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1144
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19580.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2032
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-heap-l1-1-0.dll" /a
    3⤵
    PID:2752
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ContentDeliveryManager_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2848
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.bin" /grant Administrators:F /t
    3⤵
    PID:3344
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:4628
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5940
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-heap-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:3692
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ContentDeliveryManager_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1204
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:4844
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\OpenSave\ClearRestart.gif" /a
    3⤵
    PID:3960
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.NarratorQuickStart_10.0.26100.1_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:1524
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-locale-l1-1-0.dll" /a
    3⤵
    PID:1076
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ContentDeliveryManager_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:6072
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2648
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\OpenSave\ClearRestart.gif" /grant Administrators:F /t
    3⤵
    PID:1176
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.NarratorQuickStart_10.0.26100.1_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1836
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-locale-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:1228
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ContentDeliveryManager_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2508
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    - Modifies file permissions
    PID:6048
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-math-l1-1-0.dll" /a
    3⤵
    PID:4684
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3400
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\OpenSave\MountLimit.jpeg" /a
    3⤵
    PID:3032
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4472
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5652
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.NarratorQuickStart_10.0.26100.1_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:2280
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\OpenSave\MountLimit.jpeg" /grant Administrators:F /t
    3⤵
    PID:5440
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-math-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:4212
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.NarratorQuickStart_10.0.26100.1_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:576
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:5852
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3916
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5912
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3484
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-multibyte-l1-1-0.dll" /a
    3⤵
    PID:2936
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\OptimizeDisconnect\CompleteCompare.jpeg" /a
    3⤵
    PID:1660
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ParentalControls_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:4152
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2968
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2756
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-multibyte-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:932
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\OptimizeDisconnect\CompleteCompare.jpeg" /grant Administrators:F /t
    3⤵
    PID:1296
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ParentalControls_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:5736
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5488
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PeopleExperienceHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2904
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2688
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-private-l1-1-0.dll" /a
    3⤵
    PID:1460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5200
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\OptimizeDisconnect\ExitConvertFrom.avi" /a
    3⤵
    PID:948
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PeopleExperienceHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2964
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ParentalControls_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:6120
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\OptimizeDisconnect\ExitConvertFrom.avi" /grant Administrators:F /t
    3⤵
    PID:4964
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-private-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:3676
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PinningConfirmationDialog_1000.25140.1001.0_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:5788
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3888
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ParentalControls_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:5552
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PeopleExperienceHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:336
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PinningConfirmationDialog_1000.25140.1001.0_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5516
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\OptimizeDisconnect\ExitPublish.gif" /a
    3⤵
    PID:404
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-process-l1-1-0.dll" /a
    3⤵
    PID:1872
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PeopleExperienceHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3184
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PrintQueueActionCenter_1.0.2.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:992
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\OptimizeDisconnect\ExitPublish.gif" /grant Administrators:F /t
    3⤵
    PID:908
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-process-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:5920
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2276
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PinningConfirmationDialog_1000.25140.1001.0_neutral__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    - Possible privilege escalation attempt
    PID:204
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PrintQueueActionCenter_1.0.2.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2844
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PinningConfirmationDialog_1000.25140.1001.0_neutral__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1228
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:1836
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\OptimizeDisconnect\ReceiveCompare.mov" /a
    3⤵
    PID:3232
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-runtime-l1-1-0.dll" /a
    3⤵
    PID:2420
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\OptimizeDisconnect\ReceiveCompare.mov" /grant Administrators:F /t
    3⤵
    PID:3288
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3400
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-runtime-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:3448
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PrintQueueActionCenter_1.0.2.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3660
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PrintQueueActionCenter_1.0.2.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:4456
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.26100.1301_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:1188
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\OptimizeDisconnect\SaveApprove.jpg" /a
    3⤵
    PID:5852
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-stdio-l1-1-0.dll" /a
    3⤵
    PID:2788
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:6116
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.26100.1301_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5192
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\OptimizeDisconnect\SaveApprove.jpg" /grant Administrators:F /t
    3⤵
    PID:5312
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-stdio-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:5072
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.26100.1301_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2084
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:392
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.26100.1301_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3748
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.26100.1301_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:2808
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopCopy\CloseDisconnect.jpg" /a
    3⤵
    PID:2668
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.26100.1301_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3892
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2660
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopCopy\CloseDisconnect.jpg" /grant Administrators:F /t
    3⤵
    PID:5880
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-string-l1-1-0.dll" /a
    3⤵
    PID:4760
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:5804
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.26100.1301_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:1612
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-string-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:4692
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopCopy\ConvertLimit.rar" /a
    3⤵
    PID:5712
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1436
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.26100.1301_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1000
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:320
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.CBS_5001.184.1607.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:4896
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopCopy\ConvertLimit.rar" /grant Administrators:F /t
    3⤵
    PID:1428
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-time-l1-1-0.dll" /a
    3⤵
    - Modifies file permissions
    PID:3408
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:1620
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.CBS_5001.184.1607.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:4312
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-time-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:832
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopCopy\DenyPublish.png" /a
    3⤵
    PID:336
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5788
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameCallableUI_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:6124
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.CBS_5001.184.1607.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:5936
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopCopy\DenyPublish.png" /grant Administrators:F /t
    3⤵
    PID:3164
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-utility-l1-1-0.dll" /a
    3⤵
    PID:3848
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameCallableUI_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2828
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.CBS_5001.184.1607.0_x64__8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:3596
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-utility-l1-1-0.dll" /grant Administrators:F /t
    3⤵
    PID:2216
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.AIX_1000.26100.29.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    - Modifies file permissions
    PID:2332
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopCopy\PushWait.xls" /a
    3⤵
    PID:2488
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameCallableUI_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2356
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png" /a
    3⤵
    - Modifies file permissions
    PID:5824
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.AIX_1000.26100.29.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2280
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopCopy\PushWait.xls" /grant Administrators:F /t
    3⤵
    PID:2328
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameCallableUI_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1160
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png" /grant Administrators:F /t
    3⤵
    PID:4116
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.CBS_1000.26100.18.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:5992
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.AIX_1000.26100.29.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3580
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopCopy\ReceiveFind.avi" /a
    3⤵
    PID:2476
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.CBS_1000.26100.18.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:4184
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png" /a
    3⤵
    PID:4248
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.AIX_1000.26100.29.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3500
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopCopy\ReceiveFind.avi" /grant Administrators:F /t
    3⤵
    PID:2572
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Core_1000.26100.19.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:5108
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png" /grant Administrators:F /t
    3⤵
    PID:5980
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.CBS_1000.26100.18.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3328
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Core_1000.26100.19.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5116
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.CBS_1000.26100.18.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3508
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopCopy\SearchImport.mov" /a
    3⤵
    PID:6120
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png" /a
    3⤵
    PID:2784
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Core_1000.26100.19.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3676
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.FileExp_1000.26100.3.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:1144
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopCopy\SearchImport.mov" /grant Administrators:F /t
    3⤵
    PID:4968
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png" /grant Administrators:F /t
    3⤵
    PID:2412
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.FileExp_1000.26100.3.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1032
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Core_1000.26100.19.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:308
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.OOBE_1000.26100.2.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:1956
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.FileExp_1000.26100.3.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3132
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:908
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopCopy\SearchMove.txt" /a
    3⤵
    PID:4756
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png" /a
    3⤵
    PID:2148
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.OOBE_1000.26100.2.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:5552
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5060
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png" /grant Administrators:F /t
    3⤵
    PID:992
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.FileExp_1000.26100.3.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5572
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopCopy\SearchMove.txt" /grant Administrators:F /t
    3⤵
    PID:1584
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Photon_1000.26100.4.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:5756
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.OOBE_1000.26100.2.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:5788
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3164
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Photon_1000.26100.4.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:200
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.OOBE_1000.26100.2.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3824
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopCopy\UndoResolve.7z" /a
    3⤵
    PID:4136
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3444
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.gif" /a
    3⤵
    PID:5188
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Photon_1000.26100.4.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:4684
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopCopy\UndoResolve.7z" /grant Administrators:F /t
    3⤵
    PID:2420
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3660
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.AccountsService_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:1344
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.gif" /grant Administrators:F /t
    3⤵
    PID:5856
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.AccountsService_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:4412
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Photon_1000.26100.4.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1340
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.AccountsService_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    - Possible privilege escalation attempt
    PID:2280
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.IrisService_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2936
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopImport\ApproveStart.avi" /a
    3⤵
    PID:4260
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png" /a
    3⤵
    PID:1896
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.IrisService_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2084
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.AccountsService_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2472
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopImport\ApproveStart.avi" /grant Administrators:F /t
    3⤵
    PID:5848
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:5736
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.Search_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2572
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.IrisService_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:4348
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png" /a
    3⤵
    PID:2884
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.IrisService_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:940
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.Search_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:5204
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png" /grant Administrators:F /t
    3⤵
    PID:3944
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopImport\CompleteSave.txt" /a
    3⤵
    PID:3344
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.Search_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    - Possible privilege escalation attempt
    PID:1272
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\NcsiUwpApp_1000.25128.1000.0_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    - Possible privilege escalation attempt
    PID:1764
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopImport\CompleteSave.txt" /grant Administrators:F /t
    3⤵
    PID:948
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png" /a
    3⤵
    PID:2012
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\NcsiUwpApp_1000.25128.1000.0_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:2912
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.Search_1000.26100.1742.0_x64__cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1032
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopImport\GroupSelect.bmp" /a
    3⤵
    PID:1204
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png" /grant Administrators:F /t
    3⤵
    PID:1408
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\NcsiUwpApp_1000.25128.1000.0_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat" /a
    3⤵
    PID:2812
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3292
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopImport\GroupSelect.bmp" /grant Administrators:F /t
    3⤵
    PID:5292
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\NcsiUwpApp_1000.25128.1000.0_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:2652
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:204
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png" /a
    3⤵
    PID:5792
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2484
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6100
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.8.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3804
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png" /grant Administrators:F /t
    3⤵
    PID:336
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopImport\RequestRepair.xlsx" /a
    3⤵
    PID:6048
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:4144
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.8.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:6124
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ETWlog.dll" /a
    3⤵
    PID:5968
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5652
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.8.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2992
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopImport\RequestRepair.xlsx" /grant Administrators:F /t
    3⤵
    PID:2392
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.PrintDialog_6.2.3.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:2508
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ETWlog.dll" /grant Administrators:F /t
    3⤵
    PID:3824
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.8.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:3904
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.PrintDialog_6.2.3.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:1340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2760
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe" /a
    3⤵
    PID:5656
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Windows.PrintDialog_6.2.3.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /a
    3⤵
    PID:3608
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat" /a
    3⤵
    PID:4564
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\PopImport\SelectSubmit.doc" /a
    3⤵
    PID:1160
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat" /a
    3⤵
    PID:5208
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe" /grant Administrators:F /t
    3⤵
    PID:5896
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Windows.PrintDialog_6.2.3.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat" /grant Administrators:F /t
    3⤵
    PID:4116
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\PopImport\SelectSubmit.doc" /grant Administrators:F /t
    3⤵
    PID:2756
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat" /grant Administrators:F /t
    3⤵
    PID:3500
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5736
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows\ClipSVC\tokens.dat" /a
    3⤵
    PID:4348
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:4196
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll" /a
    3⤵
    PID:4500
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuthLib.dll" /a
    3⤵
    PID:3888
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows\ClipSVC\tokens.dat" /grant Administrators:F /t
    3⤵
    PID:4548
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\RemoveAssert\ConvertFromFormat.xlsx" /a
    3⤵
    PID:3676
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat" /a
    3⤵
    PID:1092
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuthLib.dll" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:816
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll" /grant Administrators:F /t
    3⤵
    PID:2088
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll" /a
    3⤵
    PID:3980
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\RemoveAssert\ConvertFromFormat.xlsx" /grant Administrators:F /t
    3⤵
    PID:4536
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat" /grant Administrators:F /t
    3⤵
    PID:1000
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll" /grant Administrators:F /t
    3⤵
    PID:2344
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\settings.dat" /a
    3⤵
    PID:3052
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.LocalizedResources.dll" /a
    3⤵
    PID:1524
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\RemoveAssert\ConvertToStop.png" /a
    3⤵
    PID:5552
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Default\NTUSER.DAT" /a
    3⤵
    PID:2148
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\settings.dat" /grant Administrators:F /t
    3⤵
    PID:2812
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.LocalizedResources.dll" /grant Administrators:F /t
    3⤵
    PID:728
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\RemoveAssert\ConvertToStop.png" /grant Administrators:F /t
    3⤵
    PID:5792
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Default\NTUSER.DAT" /grant Administrators:F /t
    3⤵
    PID:5380
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat" /a
    3⤵
    PID:2488
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\Settings\settings.dat" /a
    3⤵
    PID:4244
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\RemoveAssert\ConvertToWrite.zip" /a
    3⤵
    PID:3384
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat" /grant Administrators:F /t
    3⤵
    PID:1836
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.Resources.dll" /a
    3⤵
    PID:4400
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\Settings\settings.dat" /grant Administrators:F /t
    3⤵
    PID:1168
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png" /a
    3⤵
    PID:6124
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\RemoveAssert\ConvertToWrite.zip" /grant Administrators:F /t
    3⤵
    PID:5948
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.Resources.dll" /grant Administrators:F /t
    3⤵
    PID:4616
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCacheLock.dat" /a
    3⤵
    - Modifies file permissions
    PID:1188
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png" /grant Administrators:F /t
    3⤵
    PID:328
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat" /a
    3⤵
    PID:5956
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCacheLock.dat" /grant Administrators:F /t
    3⤵
    PID:5688
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat" /grant Administrators:F /t
    3⤵
    PID:5192
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin" /a
    3⤵
    PID:3716
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\RemoveAssert\OptimizeSwitch.odt" /a
    3⤵
    PID:3580
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncApi.dll" /a
    3⤵
    PID:1624
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png" /a
    3⤵
    PID:4764
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat" /a
    3⤵
    PID:3644
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin" /grant Administrators:F /t
    3⤵
    PID:1300
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png" /grant Administrators:F /t
    3⤵
    PID:5304
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\RemoveAssert\OptimizeSwitch.odt" /grant Administrators:F /t
    3⤵
    PID:4896
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncApi.dll" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:2848
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat" /grant Administrators:F /t
    3⤵
    PID:940
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncClient.dll" /a
    3⤵
    PID:5804
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\RemoveAssert\ProtectExpand.mp4" /a
    3⤵
    PID:1612
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\container.dat" /a
    3⤵
    PID:4548
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2184
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png" /a
    3⤵
    PID:4500
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat" /a
    3⤵
    PID:2988
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncClient.dll" /grant Administrators:F /t
    3⤵
    PID:2480
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\RemoveAssert\ProtectExpand.mp4" /grant Administrators:F /t
    3⤵
    PID:5648
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png" /grant Administrators:F /t
    3⤵
    PID:3044
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\container.dat" /grant Administrators:F /t
    3⤵
    PID:1872
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat" /grant Administrators:F /t
    3⤵
    PID:2412
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png" /a
    3⤵
    PID:1032
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png" /grant Administrators:F /t
    3⤵
    PID:3052
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012026070920260710\container.dat" /a
    3⤵
    PID:2592
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\INetCache\container.dat" /a
    3⤵
    PID:5000
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\RemoveAssert\RestoreRevoke.jpeg" /a
    3⤵
    PID:6076
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe" /a
    3⤵
    PID:632
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png" /a
    3⤵
    - Possible privilege escalation attempt
    PID:2356
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1440
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012026070920260710\container.dat" /grant Administrators:F /t
    3⤵
    PID:4088
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\INetCache\container.dat" /grant Administrators:F /t
    3⤵
    PID:6112
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\RemoveAssert\RestoreRevoke.jpeg" /grant Administrators:F /t
    3⤵
    PID:5760
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1572
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe" /grant Administrators:F /t
    3⤵
    PID:1016
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png" /grant Administrators:F /t
    3⤵
    PID:1344
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\IECompatCache\container.dat" /a
    3⤵
    PID:4468
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\INetCookies\ESE\container.dat" /a
    3⤵
    PID:4832
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IECompatCache\container.dat" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:392
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFAL.dll" /a
    3⤵
    PID:4184
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png" /a
    3⤵
    PID:5956
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\INetCookies\ESE\container.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:3008
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\RemoveAssert\WaitFind.txt" /a
    3⤵
    PID:4232
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png" /grant Administrators:F /t
    3⤵
    PID:1340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1740
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\IECompatUaCache\container.dat" /a
    3⤵
    PID:5208
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFAL.dll" /grant Administrators:F /t
    3⤵
    PID:5656
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\RemoveAssert\WaitFind.txt" /grant Administrators:F /t
    3⤵
    PID:4564
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IECompatUaCache\container.dat" /grant Administrators:F /t
    3⤵
    PID:2976
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start2.bin" /a
    3⤵
    PID:5748
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFALWB.dll" /a
    3⤵
    PID:3716
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\RemoveBackup\InvokeConvertTo.doc" /a
    3⤵
    PID:1624
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6044
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\container.dat" /a
    3⤵
    PID:5588
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png" /a
    3⤵
    PID:4760
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFALWB.dll" /grant Administrators:F /t
    3⤵
    PID:3180
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\container.dat" /grant Administrators:F /t
    3⤵
    PID:4692
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\RemoveBackup\InvokeConvertTo.doc" /grant Administrators:F /t
    3⤵
    PID:2608
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start2.bin" /grant Administrators:F /t
    3⤵
    PID:1256
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5028
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png" /grant Administrators:F /t
    3⤵
    PID:5292
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\96PJ9BGF\{8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp" /a
    3⤵
    PID:1672
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncSessions.dll" /a
    3⤵
    PID:816
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat" /a
    3⤵
    PID:1872
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\RemoveBackup\SuspendProtect.docx" /a
    3⤵
    PID:3044
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png" /a
    3⤵
    PID:3132
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncSessions.dll" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:2480
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\96PJ9BGF\{8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp" /grant Administrators:F /t
    3⤵
    PID:1620
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1032
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\RemoveBackup\SuspendProtect.docx" /grant Administrators:F /t
    3⤵
    PID:804
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png" /grant Administrators:F /t
    3⤵
    PID:3648
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3380
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat" /grant Administrators:F /t
    3⤵
    PID:576
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat" /a
    3⤵
    PID:3376
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\RemoveBackup\SwitchRevoke.ico" /a
    3⤵
    PID:2420
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll" /a
    3⤵
    PID:2332
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\DNTException\container.dat" /a
    3⤵
    PID:624
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png" /a
    3⤵
    PID:5756
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat" /grant Administrators:F /t
    3⤵
    PID:1016
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll" /grant Administrators:F /t
    3⤵
    PID:3140
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png" /grant Administrators:F /t
    3⤵
    PID:1124
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\RemoveBackup\SwitchRevoke.ico" /grant Administrators:F /t
    3⤵
    PID:5880
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\DNTException\container.dat" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:5948
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3040
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png" /a
    3⤵
    PID:5912
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ESE\container.dat" /a
    3⤵
    PID:2752
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncViews.dll" /a
    3⤵
    PID:6020
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png" /grant Administrators:F /t
    3⤵
    PID:2756
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_4_PNGEncoded_Data.bin" /a
    3⤵
    PID:3008
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\ResumeDeny\CompleteDeny.tiff" /a
    3⤵
    PID:3920
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncViews.dll" /grant Administrators:F /t
    3⤵
    PID:5308
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ESE\container.dat" /grant Administrators:F /t
    3⤵
    PID:2364
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\ResumeDeny\CompleteDeny.tiff" /grant Administrators:F /t
    3⤵
    PID:3244
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_4_PNGEncoded_Data.bin" /grant Administrators:F /t
    3⤵
    PID:4376
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3644
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png" /a
    3⤵
    PID:4612
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE\container.dat" /a
    3⤵
    PID:2568
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_4_PNGEncoded_Header.bin" /a
    3⤵
    PID:5116
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE\container.dat" /grant Administrators:F /t
    3⤵
    PID:4816
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png" /grant Administrators:F /t
    3⤵
    PID:2784
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_4_PNGEncoded_Header.bin" /grant Administrators:F /t
    3⤵
    PID:4304
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1624
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\ResumeDeny\SplitApprove.exe" /a
    3⤵
    PID:304
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_125_4_PNGEncoded_Data.bin" /a
    3⤵
    PID:2504
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcfile.dll" /a
    3⤵
    PID:6064
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\ResumeDeny\SplitApprove.exe" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:5272
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_125_4_PNGEncoded_Data.bin" /grant Administrators:F /t
    3⤵
    PID:4596
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" /a
    3⤵
    PID:4844
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png" /a
    3⤵
    PID:3848
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4500
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcfile.dll" /grant Administrators:F /t
    3⤵
    PID:1956
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" /grant Administrators:F /t
    3⤵
    PID:4544
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\ResumeDeny\TestInvoke.rar" /a
    3⤵
    PID:1256
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png" /grant Administrators:F /t
    3⤵
    PID:4944
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.DesktopStickerEditorCentennial.exe" /a
    3⤵
    PID:2328
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4180
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcsecproc.dll" /a
    3⤵
    PID:1880
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_125_4_PNGEncoded_Header.bin" /a
    3⤵
    PID:3648
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\ResumeDeny\TestInvoke.rar" /grant Administrators:F /t
    3⤵
    PID:1336
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png" /a
    3⤵
    PID:5760
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.DesktopStickerEditorCentennial.exe" /grant Administrators:F /t
    3⤵
    PID:2744
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5284
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcsecproc.dll" /grant Administrators:F /t
    3⤵
    PID:2508
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_125_4_PNGEncoded_Header.bin" /grant Administrators:F /t
    3⤵
    PID:3916
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msipc.dll" /a
    3⤵
    PID:2260
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png" /grant Administrators:F /t
    3⤵
    PID:1936
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\SelectRepair\DebugUnlock.bmp" /a
    3⤵
    PID:5312
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png" /a
    3⤵
    PID:4084
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCache\container.dat" /a
    3⤵
    PID:2832
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msipc.dll" /grant Administrators:F /t
    3⤵
    PID:4200
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png" /grant Administrators:F /t
    3⤵
    PID:2536
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCache\container.dat" /grant Administrators:F /t
    3⤵
    PID:4832
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\SelectRepair\DebugUnlock.bmp" /grant Administrators:F /t
    3⤵
    PID:4248
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png" /a
    3⤵
    PID:3328
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png" /grant Administrators:F /t
    3⤵
    PID:1160
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png" /a
    3⤵
    PID:392
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCookies\ESE\container.dat" /a
    3⤵
    PID:5308
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png" /a
    3⤵
    PID:396
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\SelectRepair\MeasureTest.jpg" /a
    3⤵
    PID:3580
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msvcp140.dll" /a
    3⤵
    PID:1460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3244
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png" /grant Administrators:F /t
    3⤵
    PID:5980
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCookies\ESE\container.dat" /grant Administrators:F /t
    3⤵
    PID:3764
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msvcp140.dll" /grant Administrators:F /t
    3⤵
    PID:3716
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\SelectRepair\MeasureTest.jpg" /grant Administrators:F /t
    3⤵
    PID:1764
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png" /grant Administrators:F /t
    3⤵
    PID:3172
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png" /a
    3⤵
    PID:1332
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png" /grant Administrators:F /t
    3⤵
    PID:5648
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\container.dat" /a
    3⤵
    PID:2340
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png" /a
    3⤵
    PID:4628
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2012
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png" /a
    3⤵
    PID:1768
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\SelectRepair\RenameClear.tiff" /a
    3⤵
    PID:4312
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\container.dat" /grant Administrators:F /t
    3⤵
    PID:204
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:2480
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libeay32.dll" /a
    3⤵
    PID:3044
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\SelectRepair\RenameClear.tiff" /grant Administrators:F /t
    3⤵
    PID:1956
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png" /grant Administrators:F /t
    3⤵
    PID:4212
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{183b3e3f-6b76-453e-8324-537d3c182bfc}\appsconversions.txt" /a
    3⤵
    PID:3052
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libeay32.dll" /grant Administrators:F /t
    3⤵
    PID:2360
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe" /a
    3⤵
    PID:6024
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\SelectRepair\UpdateDeny.doc" /a
    3⤵
    PID:6048
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1256
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{183b3e3f-6b76-453e-8324-537d3c182bfc}\appsconversions.txt" /grant Administrators:F /t
    3⤵
    PID:332
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png" /a
    3⤵
    PID:632
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe" /grant Administrators:F /t
    3⤵
    PID:5680
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\SelectRepair\UpdateDeny.doc" /grant Administrators:F /t
    3⤵
    PID:3916
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3748
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png" /grant Administrators:F /t
    3⤵
    PID:5504
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libEGL.dll" /a
    3⤵
    PID:4616
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{183b3e3f-6b76-453e-8324-537d3c182bfc}\appsglobals.txt" /a
    3⤵
    PID:3500
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libEGL.dll" /grant Administrators:F /t
    3⤵
    PID:4468
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png" /a
    3⤵
    PID:5992
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{183b3e3f-6b76-453e-8324-537d3c182bfc}\appsglobals.txt" /grant Administrators:F /t
    3⤵
    PID:2832
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\SubmitUse\EnterExit.mp4" /a
    3⤵
    PID:2052
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libGLESv2.dll" /a
    3⤵
    PID:3608
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png" /grant Administrators:F /t
    3⤵
    PID:2536
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3920
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\SubmitUse\EnterExit.mp4" /grant Administrators:F /t
    3⤵
    PID:5912
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libGLESv2.dll" /grant Administrators:F /t
    3⤵
    PID:1144
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{183b3e3f-6b76-453e-8324-537d3c182bfc}\appssynonyms.txt" /a
    3⤵
    PID:3888
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{183b3e3f-6b76-453e-8324-537d3c182bfc}\appssynonyms.txt" /grant Administrators:F /t
    3⤵
    PID:4840
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png" /a
    3⤵
    PID:2648
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Core.dll" /a
    3⤵
    PID:1912
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\SubmitUse\FindSwitch.odt" /a
    3⤵
    PID:5892
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoggingPlatform.dll" /a
    3⤵
    PID:1892
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoggingPlatform.dll" /grant Administrators:F /t
    3⤵
    PID:4756
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\SubmitUse\FindSwitch.odt" /grant Administrators:F /t
    3⤵
    PID:3476
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png" /grant Administrators:F /t
    3⤵
    PID:5748
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Core.dll" /grant Administrators:F /t
    3⤵
    PID:4168
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{183b3e3f-6b76-453e-8324-537d3c182bfc}\settingsconversions.txt" /a
    3⤵
    PID:5648
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\SubmitUse\JoinUnpublish.mp3" /a
    3⤵
    PID:2124
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png" /a
    3⤵
    PID:1672
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5DBus.dll" /a
    3⤵
    PID:832
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{183b3e3f-6b76-453e-8324-537d3c182bfc}\settingsconversions.txt" /grant Administrators:F /t
    3⤵
    PID:4596
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogUploader.dll" /a
    3⤵
    PID:2828
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3848
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png" /grant Administrators:F /t
    3⤵
    PID:576
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogUploader.dll" /grant Administrators:F /t
    3⤵
    PID:2456
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5DBus.dll" /grant Administrators:F /t
    3⤵
    PID:5692
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Roaming\SubmitUse\JoinUnpublish.mp3" /grant Administrators:F /t
    3⤵
    PID:4944
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{183b3e3f-6b76-453e-8324-537d3c182bfc}\settingsglobals.txt" /a
    3⤵
    PID:5824
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Gui.dll" /a
    3⤵
    PID:1880
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{183b3e3f-6b76-453e-8324-537d3c182bfc}\settingsglobals.txt" /grant Administrators:F /t
    3⤵
    PID:2360
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Gui.dll" /grant Administrators:F /t
    3⤵
    PID:5852
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png" /a
    3⤵
    PID:6076
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Roaming\SubmitUse\ResumeShow.xlsx" /a
    3⤵
    PID:5756
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Network.dll" /a
    3⤵
    PID:6024
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png" /grant Administrators:F /t
    3⤵
    - Modifies file permissions
    PID:4412
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{183b3e3f-6b76-453e-8324-537d3c182bfc}\settingssynonyms.txt" /a
    3⤵
    PID:1512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:372

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2472

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

tmp2997.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp2997.tmp
Size 30KB
SHA256 8c7d1e15b03ab8704ab291fef7a4ef597e69ecccba6b891cc54bccbfbdccae7a
MD5 4cc1f93a2c6149a9aaa77fadb01f74c9
SHA1 9c9ba30ef61377c2fff0204097243ccc1214b4af
SHA512 ad626c7a7ac17a9f2364a6c4e48c6b596fc6cfbdb06510c17d9229de45bfbf1446cf19673a1bbacba9026ee95d0b78b7d26df0ac61bcedaedbaebcadc18aed20
SSDEEP 768:3abWhwyeiu/0iHTU8du59NlHG/q0JpntrriH:3ZK3g8du59NlHGSirWH
TLSH
T1B9E2D6447BF98614F6FF6FBA4E7241114B39BC96A836D70D1A84548F08B2F08CDA4B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-16-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/8-15-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/2916-8-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/2916-9-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/2916-10-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/2916-11-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/2916-12-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/2916-5-0x0000000000AA0000-0x0000000000AAE000-memory.dmp

Download

memory/2916-4-0x00007FFA5146F000-0x00007FFA51470000-memory.dmp

Download

memory/2916-25-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/2916-116-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/2916-123-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/2916-148-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/2916-1202-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download