Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 03:09
Static task
static1
Behavioral task
behavioral1
Sample
target.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
target.vbs
Resource
win10v2004-20240802-en
General
-
Target
target.vbs
-
Size
828B
-
MD5
333ac8009978dfe4bc0e7ea72ad31289
-
SHA1
a8bc098f840e1b0faadb82d1087cf571e979a80d
-
SHA256
087315508cc43b632dae4750608cf107dfd454e2beacb03eeb4b43d013906d3d
-
SHA512
9a3886771f4b12576d9e155077b968b63932689a42e31e2d32642d6a9a46030e2157ea4da58bfddae5a6b37200174a990095e6f9776411a59f8b302fb7a42f9d
Malware Config
Signatures
-
Renames multiple (1934) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Possible privilege escalation attempt 64 IoCs
Processes:
takeown.exetakeown.exetakeown.exetakeown.exetakeown.exeicacls.exetakeown.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exepid Process 3732 4000 1164 3712 840 4336 2816 takeown.exe 3932 takeown.exe 4200 5084 4744 takeown.exe 216 takeown.exe 2340 1164 3488 544 takeown.exe 3416 icacls.exe 3108 228 3884 takeown.exe 4628 4024 4836 1540 4356 4932 4880 1380 3640 952 1616 takeown.exe 1100 2964 408 700 2884 4560 takeown.exe 2944 3284 4060 4872 4872 3120 icacls.exe 1912 4604 4200 4780 1392 2376 4180 takeown.exe 4552 icacls.exe 2240 4472 208 744 1212 844 icacls.exe 2120 1932 4144 4980 1400 3668 2964 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation WScript.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Modifies file permissions 1 TTPs 64 IoCs
Processes:
takeown.exeicacls.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exeicacls.exeicacls.exepid Process 2236 takeown.exe 4060 icacls.exe 1520 3452 4764 1824 1620 takeown.exe 2684 4228 4372 3728 4460 1456 440 232 4268 64 808 1516 1196 takeown.exe 4316 takeown.exe 2264 3380 1396 4888 1924 takeown.exe 2004 232 772 4432 takeown.exe 4984 4692 1684 844 2156 2576 64 3952 1212 4496 takeown.exe 1552 1656 2068 532 428 3440 3608 takeown.exe 3792 icacls.exe 3212 2372 1312 4720 2728 4780 4528 1640 3580 4444 5116 icacls.exe 4356 4532 4632 1028 4244 -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WScript.exepid Process 388 WScript.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
WScript.exepid Process 388 WScript.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
WScript.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 388 wrote to memory of 4920 388 WScript.exe 82 PID 388 wrote to memory of 4920 388 WScript.exe 82 PID 4920 wrote to memory of 2928 4920 cmd.exe 84 PID 4920 wrote to memory of 2928 4920 cmd.exe 84 PID 4920 wrote to memory of 404 4920 cmd.exe 85 PID 4920 wrote to memory of 404 4920 cmd.exe 85 PID 388 wrote to memory of 3948 388 WScript.exe 86 PID 388 wrote to memory of 3948 388 WScript.exe 86 PID 3948 wrote to memory of 1572 3948 cmd.exe 88 PID 3948 wrote to memory of 1572 3948 cmd.exe 88 PID 3948 wrote to memory of 1104 3948 cmd.exe 89 PID 3948 wrote to memory of 1104 3948 cmd.exe 89 PID 388 wrote to memory of 2892 388 WScript.exe 90 PID 388 wrote to memory of 2892 388 WScript.exe 90 PID 2892 wrote to memory of 1424 2892 cmd.exe 92 PID 2892 wrote to memory of 1424 2892 cmd.exe 92 PID 388 wrote to memory of 4312 388 WScript.exe 93 PID 388 wrote to memory of 4312 388 WScript.exe 93 PID 4312 wrote to memory of 1932 4312 cmd.exe 95 PID 4312 wrote to memory of 1932 4312 cmd.exe 95 PID 4312 wrote to memory of 2640 4312 cmd.exe 96 PID 4312 wrote to memory of 2640 4312 cmd.exe 96 PID 388 wrote to memory of 4452 388 WScript.exe 97 PID 388 wrote to memory of 4452 388 WScript.exe 97 PID 4452 wrote to memory of 3728 4452 cmd.exe 99 PID 4452 wrote to memory of 3728 4452 cmd.exe 99 PID 4452 wrote to memory of 3284 4452 cmd.exe 100 PID 4452 wrote to memory of 3284 4452 cmd.exe 100 PID 388 wrote to memory of 2004 388 WScript.exe 101 PID 388 wrote to memory of 2004 388 WScript.exe 101 PID 2004 wrote to memory of 452 2004 cmd.exe 103 PID 2004 wrote to memory of 452 2004 cmd.exe 103 PID 2004 wrote to memory of 844 2004 cmd.exe 104 PID 2004 wrote to memory of 844 2004 cmd.exe 104 PID 388 wrote to memory of 4244 388 WScript.exe 105 PID 388 wrote to memory of 4244 388 WScript.exe 105 PID 4244 wrote to memory of 1040 4244 cmd.exe 107 PID 4244 wrote to memory of 1040 4244 cmd.exe 107 PID 4244 wrote to memory of 3048 4244 cmd.exe 108 PID 4244 wrote to memory of 3048 4244 cmd.exe 108 PID 388 wrote to memory of 3732 388 WScript.exe 109 PID 388 wrote to memory of 3732 388 WScript.exe 109 PID 3732 wrote to memory of 2732 3732 cmd.exe 111 PID 3732 wrote to memory of 2732 3732 cmd.exe 111 PID 3732 wrote to memory of 4428 3732 cmd.exe 112 PID 3732 wrote to memory of 4428 3732 cmd.exe 112 PID 388 wrote to memory of 2404 388 WScript.exe 113 PID 388 wrote to memory of 2404 388 WScript.exe 113 PID 2404 wrote to memory of 4440 2404 cmd.exe 115 PID 2404 wrote to memory of 4440 2404 cmd.exe 115 PID 2404 wrote to memory of 1516 2404 cmd.exe 116 PID 2404 wrote to memory of 1516 2404 cmd.exe 116 PID 388 wrote to memory of 4932 388 WScript.exe 117 PID 388 wrote to memory of 4932 388 WScript.exe 117 PID 4932 wrote to memory of 4692 4932 cmd.exe 119 PID 4932 wrote to memory of 4692 4932 cmd.exe 119 PID 4932 wrote to memory of 1968 4932 cmd.exe 120 PID 4932 wrote to memory of 1968 4932 cmd.exe 120 PID 388 wrote to memory of 4988 388 WScript.exe 121 PID 388 wrote to memory of 4988 388 WScript.exe 121 PID 4988 wrote to memory of 4456 4988 cmd.exe 123 PID 4988 wrote to memory of 4456 4988 cmd.exe 123 PID 4988 wrote to memory of 4884 4988 cmd.exe 124 PID 4988 wrote to memory of 4884 4988 cmd.exe 124
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\target.vbs"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\ && icacls C:\Users\ /grant everyone:(f)2⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\3⤵PID:2928
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\ /grant everyone:(f)3⤵PID:404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin && icacls C:\Users\Admin /grant everyone:(f)2⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin3⤵PID:1572
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin /grant everyone:(f)3⤵PID:1104
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\3D Objects && icacls C:\Users\Admin\3D Objects /grant everyone:(f)2⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\3D Objects3⤵PID:1424
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData && icacls C:\Users\Admin\AppData /grant everyone:(f)2⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData3⤵PID:1932
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData /grant everyone:(f)3⤵PID:2640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local && icacls C:\Users\Admin\AppData\Local /grant everyone:(f)2⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local3⤵PID:3728
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local /grant everyone:(f)3⤵PID:3284
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe && icacls C:\Users\Admin\AppData\Local\Adobe /grant everyone:(f)2⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Adobe3⤵PID:452
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Adobe /grant everyone:(f)3⤵PID:844
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat /grant everyone:(f)2⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat3⤵PID:1040
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Adobe\Acrobat /grant everyone:(f)3⤵PID:3048
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC /grant everyone:(f)2⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC3⤵PID:2732
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC /grant everyone:(f)3⤵PID:4428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache /grant everyone:(f)2⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache3⤵PID:4440
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache /grant everyone:(f)3⤵PID:1516
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr /grant everyone:(f)2⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr3⤵PID:4692
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr /grant everyone:(f)3⤵PID:1968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Color && icacls C:\Users\Admin\AppData\Local\Adobe\Color /grant everyone:(f)2⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Adobe\Color3⤵PID:4456
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Adobe\Color /grant everyone:(f)3⤵PID:4884
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles && icacls C:\Users\Admin\AppData\Local\Adobe\Color\Profiles /grant everyone:(f)2⤵PID:1888
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles3⤵PID:4992
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Adobe\Color\Profiles /grant everyone:(f)3⤵PID:1344
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Application Data && icacls C:\Users\Admin\AppData\Local\Application Data /grant everyone:(f)2⤵PID:5024
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Application Data3⤵PID:1812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Comms && icacls C:\Users\Admin\AppData\Local\Comms /grant everyone:(f)2⤵PID:4208
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Comms3⤵PID:4024
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Comms /grant everyone:(f)3⤵PID:3588
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Comms\Unistore && icacls C:\Users\Admin\AppData\Local\Comms\Unistore /grant everyone:(f)2⤵PID:1900
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Comms\Unistore3⤵PID:2016
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Comms\Unistore /grant everyone:(f)3⤵PID:3552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Comms\Unistore\data && icacls C:\Users\Admin\AppData\Local\Comms\Unistore\data /grant everyone:(f)2⤵PID:1108
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Comms\Unistore\data3⤵PID:4584
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Comms\Unistore\data /grant everyone:(f)3⤵PID:8
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Comms\Unistore\data\temp && icacls C:\Users\Admin\AppData\Local\Comms\Unistore\data\temp /grant everyone:(f)2⤵PID:1432
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Comms\Unistore\data\temp3⤵PID:936
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Comms\Unistore\data\temp /grant everyone:(f)3⤵PID:2984
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Comms\UnistoreDB && icacls C:\Users\Admin\AppData\Local\Comms\UnistoreDB /grant everyone:(f)2⤵PID:4908
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Comms\UnistoreDB3⤵PID:4820
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Comms\UnistoreDB /grant everyone:(f)3⤵PID:2476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform && icacls C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform /grant everyone:(f)2⤵PID:4300
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform3⤵PID:2928
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform /grant everyone:(f)3⤵PID:404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin && icacls C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin /grant everyone:(f)2⤵PID:4008
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin3⤵PID:1572
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin /grant everyone:(f)3⤵PID:2252
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google && icacls C:\Users\Admin\AppData\Local\Google /grant everyone:(f)2⤵PID:264
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google3⤵PID:3708
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Google /grant everyone:(f)3⤵PID:2576
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome /grant everyone:(f)2⤵PID:3088
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome3⤵PID:5056
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Google\Chrome /grant everyone:(f)3⤵PID:3700
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data /grant everyone:(f)2⤵PID:2240
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data3⤵PID:408
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates /grant everyone:(f)2⤵PID:4896
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates3⤵
- Possible privilege escalation attempt
PID:1616
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics /grant everyone:(f)2⤵PID:3156
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics3⤵PID:2528
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation /grant everyone:(f)2⤵PID:4472
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation3⤵PID:840
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad /grant everyone:(f)2⤵PID:5072
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad3⤵PID:452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments /grant everyone:(f)2⤵PID:844
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments3⤵PID:2068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports /grant everyone:(f)2⤵PID:432
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports3⤵PID:412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny /grant everyone:(f)2⤵PID:208
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny3⤵PID:440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default /grant everyone:(f)2⤵PID:3560
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default3⤵PID:4036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase /grant everyone:(f)2⤵PID:3596
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase3⤵PID:4936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage /grant everyone:(f)2⤵PID:3624
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage3⤵PID:876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\4d10e948-1e08-40a6-92eb-53a345484c0c && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\4d10e948-1e08-40a6-92eb-53a345484c0c /grant everyone:(f)2⤵PID:4260
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\4d10e948-1e08-40a6-92eb-53a345484c0c3⤵PID:3212
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase /grant everyone:(f)2⤵PID:3840
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase3⤵PID:1100
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache /grant everyone:(f)2⤵PID:4988
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache3⤵PID:4992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data /grant everyone:(f)2⤵PID:1028
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data3⤵PID:4488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db /grant everyone:(f)2⤵PID:3836
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db3⤵PID:4320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache /grant everyone:(f)2⤵PID:812
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache3⤵PID:216
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js /grant everyone:(f)2⤵PID:4208
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js3⤵PID:760
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir /grant everyone:(f)2⤵PID:4604
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir3⤵PID:1328
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm /grant everyone:(f)2⤵PID:4584
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm3⤵PID:5108
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir /grant everyone:(f)2⤵PID:2704
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir3⤵PID:4840
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db /grant everyone:(f)2⤵PID:1804
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db3⤵PID:2092
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db /grant everyone:(f)2⤵PID:5092
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db3⤵PID:224
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\databases && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\databases /grant everyone:(f)2⤵PID:2388
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\databases3⤵PID:2028
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache /grant everyone:(f)2⤵PID:2812
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache3⤵PID:2908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db /grant everyone:(f)2⤵PID:3248
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db3⤵PID:3472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service /grant everyone:(f)2⤵PID:1352
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service3⤵PID:4048
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB /grant everyone:(f)2⤵PID:2892
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB3⤵PID:4068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files /grant everyone:(f)2⤵PID:1164
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files3⤵PID:3792
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules /grant everyone:(f)2⤵PID:2916
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules3⤵PID:2684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts /grant everyone:(f)2⤵PID:3672
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts3⤵PID:4876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State /grant everyone:(f)2⤵PID:3512
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State3⤵PID:4484
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions /grant everyone:(f)2⤵PID:4000
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions3⤵PID:452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi /grant everyone:(f)2⤵PID:1400
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi3⤵PID:2168
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0 /grant everyone:(f)2⤵PID:2552
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_03⤵PID:3520
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales /grant everyone:(f)2⤵PID:3108
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales3⤵PID:4428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\af && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\af /grant everyone:(f)2⤵PID:2320
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\af3⤵PID:3820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\am && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\am /grant everyone:(f)2⤵PID:2964
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\am3⤵PID:4136
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ar && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ar /grant everyone:(f)2⤵PID:1504
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ar3⤵PID:4932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\az && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\az /grant everyone:(f)2⤵PID:4260
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\az3⤵PID:532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\be && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\be /grant everyone:(f)2⤵PID:3840
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\be3⤵PID:1676
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bg && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bg /grant everyone:(f)2⤵PID:2352
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bg3⤵PID:2932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bn && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bn /grant everyone:(f)2⤵PID:1636
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bn3⤵PID:4320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ca && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ca /grant everyone:(f)2⤵PID:4868
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ca3⤵PID:4412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cs && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cs /grant everyone:(f)2⤵PID:232
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cs3⤵PID:1904
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cy && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cy /grant everyone:(f)2⤵PID:3280
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cy3⤵PID:3552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\da && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\da /grant everyone:(f)2⤵PID:3380
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\da3⤵PID:2608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\de && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\de /grant everyone:(f)2⤵PID:4644
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\de3⤵PID:3172
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\el && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\el /grant everyone:(f)2⤵PID:4212
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\el3⤵PID:1544
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en /grant everyone:(f)2⤵PID:2092
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en3⤵PID:3616
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_CA && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_CA /grant everyone:(f)2⤵PID:4944
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_CA3⤵PID:3996
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_GB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_GB /grant everyone:(f)2⤵PID:2028
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_GB3⤵PID:1228
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_US && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_US /grant everyone:(f)2⤵PID:4900
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_US3⤵PID:3492
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es /grant everyone:(f)2⤵PID:3472
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es3⤵PID:4516
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es_419 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es_419 /grant everyone:(f)2⤵PID:4204
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es_4193⤵PID:2360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\et && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\et /grant everyone:(f)2⤵PID:1032
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\et3⤵PID:4336
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\eu && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\eu /grant everyone:(f)2⤵PID:3792
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\eu3⤵PID:2412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fa && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fa /grant everyone:(f)2⤵PID:2496
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fa3⤵PID:2528
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fi /grant everyone:(f)2⤵PID:1080
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fi3⤵PID:1768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fil && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fil /grant everyone:(f)2⤵PID:4420
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fil3⤵PID:3968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr /grant everyone:(f)2⤵PID:4960
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr3⤵PID:2004
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr_CA && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr_CA /grant everyone:(f)2⤵PID:5084
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr_CA3⤵PID:4244
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gl /grant everyone:(f)2⤵PID:412
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gl3⤵PID:3536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gu && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gu /grant everyone:(f)2⤵PID:3884
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gu3⤵PID:3568
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hi /grant everyone:(f)2⤵PID:2032
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hi3⤵PID:3820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hr /grant everyone:(f)2⤵PID:4324
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hr3⤵PID:3216
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hu && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hu /grant everyone:(f)2⤵PID:3504
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hu3⤵PID:4932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hy && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hy /grant everyone:(f)2⤵PID:4964
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hy3⤵PID:1620
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\id && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\id /grant everyone:(f)2⤵PID:4880
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\id3⤵PID:4988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\is && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\is /grant everyone:(f)2⤵PID:2372
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\is3⤵PID:4784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\it && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\it /grant everyone:(f)2⤵PID:4140
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\it3⤵PID:920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\iw && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\iw /grant everyone:(f)2⤵PID:4236
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\iw3⤵PID:812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ja && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ja /grant everyone:(f)2⤵PID:4624
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ja3⤵PID:3460
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ka && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ka /grant everyone:(f)2⤵PID:3488
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ka3⤵PID:2540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kk && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kk /grant everyone:(f)2⤵PID:2608
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kk3⤵PID:4400
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\km && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\km /grant everyone:(f)2⤵PID:1928
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\km3⤵PID:1964
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kn && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kn /grant everyone:(f)2⤵PID:2380
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kn3⤵PID:228
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ko && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ko /grant everyone:(f)2⤵PID:952
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ko3⤵PID:4300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lo && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lo /grant everyone:(f)2⤵PID:1728
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lo3⤵PID:2592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lt && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lt /grant everyone:(f)2⤵PID:404
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lt3⤵PID:4380
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lv && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lv /grant everyone:(f)2⤵PID:1088
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lv3⤵PID:3700
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ml && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ml /grant everyone:(f)2⤵PID:3364
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ml3⤵PID:4524
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mn && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mn /grant everyone:(f)2⤵PID:5056
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mn3⤵PID:3748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mr /grant everyone:(f)2⤵PID:1424
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mr3⤵PID:4896
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ms && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ms /grant everyone:(f)2⤵PID:3792
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ms3⤵PID:2116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\my && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\my /grant everyone:(f)2⤵PID:2496
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\my3⤵PID:4452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ne && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ne /grant everyone:(f)2⤵PID:1996
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ne3⤵PID:4372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\nl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\nl /grant everyone:(f)2⤵PID:2152
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\nl3⤵PID:1864
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\no && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\no /grant everyone:(f)2⤵PID:452
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\no3⤵PID:2988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pa && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pa /grant everyone:(f)2⤵PID:1400
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pa3⤵
- Possible privilege escalation attempt
PID:4180
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pl /grant everyone:(f)2⤵PID:396
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pl3⤵
- Modifies file permissions
PID:4432
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_BR && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_BR /grant everyone:(f)2⤵PID:2732
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_BR3⤵PID:4744
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_PT && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_PT /grant everyone:(f)2⤵PID:2816
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_PT3⤵PID:4136
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ro && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ro /grant everyone:(f)2⤵PID:2056
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ro3⤵PID:3308
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ru && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ru /grant everyone:(f)2⤵PID:4528
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ru3⤵PID:704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\si && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\si /grant everyone:(f)2⤵PID:1100
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\si3⤵PID:4256
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sk && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sk /grant everyone:(f)2⤵PID:2424
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sk3⤵PID:3952
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sl /grant everyone:(f)2⤵PID:2416
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sl3⤵PID:3912
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sr /grant everyone:(f)2⤵PID:1552
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sr3⤵PID:3096
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sv && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sv /grant everyone:(f)2⤵PID:2284
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sv3⤵PID:772
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sw && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sw /grant everyone:(f)2⤵PID:1512
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sw3⤵PID:1296
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ta && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ta /grant everyone:(f)2⤵PID:2628
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ta3⤵
- Modifies file permissions
PID:1196
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\te && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\te /grant everyone:(f)2⤵PID:1540
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\te3⤵PID:1784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\th && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\th /grant everyone:(f)2⤵PID:1772
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\th3⤵PID:2872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\tr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\tr /grant everyone:(f)2⤵PID:1544
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\tr3⤵PID:2092
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\uk && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\uk /grant everyone:(f)2⤵PID:2248
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\uk3⤵PID:548
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ur && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ur /grant everyone:(f)2⤵PID:4316
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ur3⤵PID:1776
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\vi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\vi /grant everyone:(f)2⤵PID:3124
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\vi3⤵PID:2200
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_CN && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_CN /grant everyone:(f)2⤵PID:2184
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_CN3⤵PID:2488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_HK && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_HK /grant everyone:(f)2⤵PID:2960
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_HK3⤵PID:3936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_TW && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_TW /grant everyone:(f)2⤵PID:3932
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_TW3⤵PID:1164
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zu && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zu /grant everyone:(f)2⤵PID:2892
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zu3⤵PID:4020
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_metadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_metadata /grant everyone:(f)2⤵PID:408
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_metadata3⤵PID:5012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda /grant everyone:(f)2⤵PID:4312
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda3⤵PID:840
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 /grant everyone:(f)2⤵PID:1996
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_03⤵PID:2452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css /grant everyone:(f)2⤵PID:4420
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css3⤵PID:3752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html /grant everyone:(f)2⤵PID:208
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html3⤵PID:4180
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images /grant everyone:(f)2⤵PID:4788
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images3⤵PID:440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales /grant everyone:(f)2⤵PID:2320
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales3⤵PID:3560
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg /grant everyone:(f)2⤵PID:2724
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg3⤵PID:1500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca /grant everyone:(f)2⤵PID:2696
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca3⤵PID:4800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs /grant everyone:(f)2⤵PID:1696
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs3⤵PID:764
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da /grant everyone:(f)2⤵PID:4012
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da3⤵PID:3840
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de /grant everyone:(f)2⤵PID:2668
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de3⤵PID:1812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el /grant everyone:(f)2⤵PID:2952
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el3⤵PID:2244
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en /grant everyone:(f)2⤵PID:1044
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en3⤵PID:1900
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB /grant everyone:(f)2⤵PID:3636
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB3⤵PID:3552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es /grant everyone:(f)2⤵PID:4040
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es3⤵PID:3488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419 /grant everyone:(f)2⤵PID:2628
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_4193⤵PID:1540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et /grant everyone:(f)2⤵PID:936
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et3⤵PID:1536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi /grant everyone:(f)2⤵PID:2388
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi3⤵PID:1408
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil /grant everyone:(f)2⤵PID:1728
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil3⤵PID:4380
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr /grant everyone:(f)2⤵PID:1392
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr3⤵PID:4124
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi /grant everyone:(f)2⤵PID:3700
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi3⤵PID:1032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr /grant everyone:(f)2⤵PID:1352
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr3⤵PID:5056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu /grant everyone:(f)2⤵PID:2240
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu3⤵PID:1556
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id /grant everyone:(f)2⤵PID:4384
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id3⤵PID:3640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it /grant everyone:(f)2⤵PID:1660
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it3⤵PID:3712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja /grant everyone:(f)2⤵PID:3220
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja3⤵PID:4876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko /grant everyone:(f)2⤵PID:2452
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko3⤵PID:1680
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt /grant everyone:(f)2⤵PID:4960
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt3⤵PID:4492
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv /grant everyone:(f)2⤵PID:1516
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv3⤵PID:3536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb /grant everyone:(f)2⤵PID:1220
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb3⤵PID:440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl /grant everyone:(f)2⤵PID:4004
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl3⤵
- Possible privilege escalation attempt
PID:2816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl /grant everyone:(f)2⤵PID:3624
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl3⤵PID:4116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR /grant everyone:(f)2⤵PID:4808
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR3⤵PID:4260
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT /grant everyone:(f)2⤵PID:4456
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT3⤵PID:1676
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro /grant everyone:(f)2⤵PID:1888
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro3⤵PID:1652
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru /grant everyone:(f)2⤵PID:1624
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru3⤵PID:4480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk /grant everyone:(f)2⤵PID:2920
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk3⤵PID:2372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl /grant everyone:(f)2⤵PID:1552
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl3⤵PID:4140
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr /grant everyone:(f)2⤵PID:1296
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr3⤵PID:3240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv /grant everyone:(f)2⤵PID:1328
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv3⤵PID:3488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th /grant everyone:(f)2⤵PID:1540
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th3⤵PID:4448
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr /grant everyone:(f)2⤵PID:3900
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr3⤵PID:3492
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk /grant everyone:(f)2⤵PID:5060
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk3⤵PID:1104
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi /grant everyone:(f)2⤵PID:916
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi3⤵PID:1560
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN /grant everyone:(f)2⤵PID:1392
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN3⤵PID:3364
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW /grant everyone:(f)2⤵PID:1088
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW3⤵PID:4204
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata /grant everyone:(f)2⤵PID:3832
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata3⤵PID:4700
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp /grant everyone:(f)2⤵PID:3932
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp3⤵PID:4348
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker /grant everyone:(f)2⤵PID:1424
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker3⤵PID:2116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB /grant everyone:(f)2⤵PID:3792
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB3⤵PID:3156
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB /grant everyone:(f)2⤵PID:4452
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB3⤵PID:4372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store /grant everyone:(f)2⤵PID:4860
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store3⤵PID:4420
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption /grant everyone:(f)2⤵PID:536
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption3⤵PID:4240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache /grant everyone:(f)2⤵PID:208
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache3⤵
- Possible privilege escalation attempt
PID:3884
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings /grant everyone:(f)2⤵PID:3596
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings3⤵PID:1504
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi /grant everyone:(f)2⤵PID:3308
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi3⤵PID:1500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage /grant everyone:(f)2⤵PID:2404
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage3⤵PID:2056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb /grant everyone:(f)2⤵PID:704
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb3⤵PID:4404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network /grant everyone:(f)2⤵PID:4532
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network3⤵PID:4256
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store /grant everyone:(f)2⤵PID:4880
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store3⤵PID:3692
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db /grant everyone:(f)2⤵PID:1072
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db3⤵PID:760
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials /grant everyone:(f)2⤵PID:1028
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials3⤵PID:1440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network /grant everyone:(f)2⤵PID:3460
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network3⤵PID:1432
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform /grant everyone:(f)2⤵PID:2024
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform3⤵
- Modifies file permissions
PID:4496
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB /grant everyone:(f)2⤵PID:3140
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB3⤵PID:632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB /grant everyone:(f)2⤵PID:4104
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB3⤵PID:2332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB /grant everyone:(f)2⤵PID:3616
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB3⤵PID:952
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker /grant everyone:(f)2⤵PID:2888
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker3⤵PID:4716
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database /grant everyone:(f)2⤵PID:4900
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database3⤵PID:2348
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache /grant everyone:(f)2⤵PID:2960
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache3⤵PID:1088
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir /grant everyone:(f)2⤵PID:3472
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir3⤵PID:4108
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage /grant everyone:(f)2⤵PID:1164
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage3⤵PID:3132
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions /grant everyone:(f)2⤵PID:4336
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions3⤵PID:2412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary /grant everyone:(f)2⤵PID:4896
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary3⤵PID:3792
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache /grant everyone:(f)2⤵PID:3156
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache3⤵PID:1912
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir /grant everyone:(f)2⤵PID:1080
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir3⤵PID:464
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db /grant everyone:(f)2⤵PID:2660
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db3⤵PID:3608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata /grant everyone:(f)2⤵PID:3520
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata3⤵PID:3716
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database /grant everyone:(f)2⤵PID:3560
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database3⤵PID:4872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage /grant everyone:(f)2⤵PID:4116
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage3⤵PID:4136
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext /grant everyone:(f)2⤵PID:2944
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext3⤵PID:2120
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda /grant everyone:(f)2⤵PID:1696
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda3⤵PID:1676
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def /grant everyone:(f)2⤵PID:2272
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def3⤵PID:4988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache /grant everyone:(f)2⤵PID:2416
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache3⤵PID:4848
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data /grant everyone:(f)2⤵PID:1636
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data3⤵PID:4412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache /grant everyone:(f)2⤵PID:4236
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache3⤵PID:376
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js /grant everyone:(f)2⤵PID:3488
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js3⤵PID:228
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir /grant everyone:(f)2⤵PID:5044
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir3⤵PID:2332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm /grant everyone:(f)2⤵PID:336
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm3⤵PID:4316
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir /grant everyone:(f)2⤵PID:3124
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir3⤵PID:4144
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache /grant everyone:(f)2⤵PID:2456
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache3⤵PID:2576
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache /grant everyone:(f)2⤵PID:3516
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache3⤵PID:1088
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage /grant everyone:(f)2⤵PID:988
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage3⤵
- Possible privilege escalation attempt
PID:3932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb /grant everyone:(f)2⤵PID:4384
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb3⤵PID:1424
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network /grant everyone:(f)2⤵PID:428
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network3⤵PID:4908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage /grant everyone:(f)2⤵PID:840
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage3⤵PID:2008
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary /grant everyone:(f)2⤵PID:4720
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary3⤵PID:1864
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache /grant everyone:(f)2⤵PID:3752
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache3⤵PID:1400
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir /grant everyone:(f)2⤵PID:732
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir3⤵PID:4428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data /grant everyone:(f)2⤵PID:396
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data3⤵PID:4936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB /grant everyone:(f)2⤵PID:1504
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB3⤵PID:2356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications /grant everyone:(f)2⤵PID:3308
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications3⤵PID:1968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources /grant everyone:(f)2⤵PID:4800
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources3⤵PID:4200
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak /grant everyone:(f)2⤵PID:704
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak3⤵PID:3416
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons /grant everyone:(f)2⤵PID:1396
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons3⤵PID:4464
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable /grant everyone:(f)2⤵PID:4060
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable3⤵PID:4472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome /grant everyone:(f)2⤵PID:1344
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome3⤵PID:376
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml /grant everyone:(f)2⤵PID:2284
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml3⤵PID:1784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons /grant everyone:(f)2⤵PID:2268
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons3⤵PID:2332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable /grant everyone:(f)2⤵PID:3992
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable3⤵
- Modifies file permissions
PID:4316
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome /grant everyone:(f)2⤵PID:5060
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome3⤵PID:4616
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf /grant everyone:(f)2⤵PID:3124
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf3⤵PID:4360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons /grant everyone:(f)2⤵PID:2252
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons3⤵
- Modifies file permissions
PID:2236
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable /grant everyone:(f)2⤵PID:2960
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable3⤵PID:5004
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome /grant everyone:(f)2⤵PID:2360
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome3⤵PID:1488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm /grant everyone:(f)2⤵PID:3132
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm3⤵PID:3220
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons /grant everyone:(f)2⤵PID:428
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons3⤵PID:2116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable /grant everyone:(f)2⤵PID:2004
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable3⤵PID:4608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome /grant everyone:(f)2⤵PID:4420
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome3⤵PID:3752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag /grant everyone:(f)2⤵PID:2552
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag3⤵PID:4180
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons /grant everyone:(f)2⤵PID:5068
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons3⤵PID:440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable /grant everyone:(f)2⤵PID:4936
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable3⤵
- Possible privilege escalation attempt
PID:4560
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome /grant everyone:(f)2⤵PID:1504
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome3⤵PID:4136
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb /grant everyone:(f)2⤵PID:1500
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb3⤵PID:2944
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons /grant everyone:(f)2⤵PID:4200
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons3⤵PID:704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable /grant everyone:(f)2⤵PID:1696
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable3⤵PID:4532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome /grant everyone:(f)2⤵PID:4256
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome3⤵PID:4880
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp /grant everyone:(f)2⤵PID:1072
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp3⤵PID:3240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage /grant everyone:(f)2⤵PID:4620
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage3⤵PID:4236
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies /grant everyone:(f)2⤵PID:4488
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies3⤵PID:1520
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded /grant everyone:(f)2⤵PID:4040
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded3⤵PID:2872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache /grant everyone:(f)2⤵PID:2592
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache3⤵PID:3248
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache /grant everyone:(f)2⤵PID:4716
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache3⤵PID:1392
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data /grant everyone:(f)2⤵PID:4048
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data3⤵PID:4776
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm /grant everyone:(f)2⤵PID:3748
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm3⤵PID:2684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64 /grant everyone:(f)2⤵PID:3724
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x643⤵PID:3452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload /grant everyone:(f)2⤵PID:2892
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload3⤵PID:4020
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel /grant everyone:(f)2⤵PID:1424
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel3⤵PID:428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints /grant everyone:(f)2⤵PID:468
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints3⤵PID:4284
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials /grant everyone:(f)2⤵PID:4492
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials3⤵PID:4420
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata /grant everyone:(f)2⤵PID:1212
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata3⤵
- Modifies file permissions
PID:3608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded /grant everyone:(f)2⤵PID:208
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded3⤵PID:4744
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved /grant everyone:(f)2⤵PID:448
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved3⤵PID:2468
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips /grant everyone:(f)2⤵PID:1528
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips3⤵PID:2320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform /grant everyone:(f)2⤵PID:64
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform3⤵PID:4044
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache /grant everyone:(f)2⤵PID:2056
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache3⤵PID:2964
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant /grant everyone:(f)2⤵PID:1960
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant3⤵PID:3056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter /grant everyone:(f)2⤵PID:4816
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter3⤵PID:4760
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules /grant everyone:(f)2⤵PID:2668
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules3⤵PID:3588
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 /grant everyone:(f)2⤵PID:4600
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList643⤵PID:3460
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TpcdMetadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TpcdMetadata /grant everyone:(f)2⤵PID:4140
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TpcdMetadata3⤵PID:2388
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments /grant everyone:(f)2⤵PID:4868
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments3⤵PID:2872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm /grant everyone:(f)2⤵PID:3488
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm3⤵PID:3700
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData /grant everyone:(f)2⤵PID:2592
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData3⤵PID:4068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History && icacls C:\Users\Admin\AppData\Local\History /grant everyone:(f)2⤵PID:4716
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\History3⤵PID:264
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\History /grant everyone:(f)3⤵PID:4048
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\History.IE5 && icacls C:\Users\Admin\AppData\Local\History\History.IE5 /grant everyone:(f)2⤵PID:4776
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\History\History.IE53⤵PID:4524
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\History\History.IE5 /grant everyone:(f)3⤵PID:5056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024080220240803 && icacls C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024080220240803 /grant everyone:(f)2⤵PID:5004
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\History\History.IE5\MSHist0120240802202408033⤵PID:1048
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024080220240803 /grant everyone:(f)3⤵PID:3968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\Low && icacls C:\Users\Admin\AppData\Local\History\Low /grant everyone:(f)2⤵PID:2480
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\History\Low3⤵PID:4348
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\History\Low /grant everyone:(f)3⤵PID:1860
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft && icacls C:\Users\Admin\AppData\Local\Microsoft /grant everyone:(f)2⤵PID:3712
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft3⤵PID:1768
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft /grant everyone:(f)3⤵PID:4248
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0 && icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0 /grant everyone:(f)2⤵PID:2168
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.03⤵PID:4484
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0 /grant everyone:(f)3⤵PID:4492
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs && icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs /grant everyone:(f)2⤵PID:4428
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs3⤵PID:1212
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs /grant everyone:(f)3⤵PID:2068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32 && icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32 /grant everyone:(f)2⤵PID:4004
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_323⤵
- Possible privilege escalation attempt
PID:4744
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32 /grant everyone:(f)3⤵
- Possible privilege escalation attempt
PID:844
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs && icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs /grant everyone:(f)2⤵PID:4444
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs3⤵PID:3108
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs /grant everyone:(f)3⤵PID:4092
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Credentials && icacls C:\Users\Admin\AppData\Local\Microsoft\Credentials /grant everyone:(f)2⤵PID:3732
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Credentials3⤵PID:4404
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\Credentials /grant everyone:(f)3⤵PID:3596
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge /grant everyone:(f)2⤵PID:2032
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge3⤵PID:4280
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\Edge /grant everyone:(f)3⤵PID:2056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data /grant everyone:(f)2⤵PID:876
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data3⤵PID:920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics /grant everyone:(f)2⤵PID:1888
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics3⤵PID:4816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation /grant everyone:(f)2⤵PID:4760
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation3⤵PID:812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad /grant everyone:(f)2⤵PID:2932
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad3⤵PID:452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports /grant everyone:(f)2⤵PID:216
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports3⤵PID:1028
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default /grant everyone:(f)2⤵PID:1044
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default3⤵PID:2928
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage /grant everyone:(f)2⤵PID:4144
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage3⤵PID:1104
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\da918e8f-3fa5-415a-8b81-97dfedab8f10 && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\da918e8f-3fa5-415a-8b81-97dfedab8f10 /grant everyone:(f)2⤵PID:3092
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\da918e8f-3fa5-415a-8b81-97dfedab8f103⤵PID:1560
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache /grant everyone:(f)2⤵PID:1392
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache3⤵PID:264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache /grant everyone:(f)2⤵PID:1940
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache3⤵PID:4524
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js /grant everyone:(f)2⤵PID:4700
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js3⤵PID:5012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir /grant everyone:(f)2⤵PID:3672
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir3⤵PID:3640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm /grant everyone:(f)2⤵PID:4876
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm3⤵PID:1860
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir /grant everyone:(f)2⤵PID:4020
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir3⤵PID:4248
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb /grant everyone:(f)2⤵PID:1912
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb3⤵PID:1400
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State /grant everyone:(f)2⤵PID:2152
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State3⤵PID:732
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache /grant everyone:(f)2⤵PID:3608
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache3⤵PID:4180
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage /grant everyone:(f)2⤵PID:4744
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage3⤵PID:396
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb /grant everyone:(f)2⤵PID:1924
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb3⤵PID:2988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage /grant everyone:(f)2⤵PID:448
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage3⤵PID:3596
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions /grant everyone:(f)2⤵PID:3732
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions3⤵PID:2944
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db /grant everyone:(f)2⤵PID:3504
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db3⤵PID:1396
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata /grant everyone:(f)2⤵PID:1960
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata3⤵PID:3840
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database /grant everyone:(f)2⤵PID:4320
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database3⤵PID:3552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data /grant everyone:(f)2⤵PID:2920
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data3⤵PID:4268
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB /grant everyone:(f)2⤵PID:1072
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB3⤵PID:4500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping /grant everyone:(f)2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2332 -
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping3⤵PID:2608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache /grant everyone:(f)2⤵PID:1520
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache3⤵PID:1532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache /grant everyone:(f)2⤵PID:3488
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache3⤵PID:3948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials /grant everyone:(f)2⤵PID:3124
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials3⤵PID:4900
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved /grant everyone:(f)2⤵PID:4204
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved3⤵PID:5056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Safe Browsing && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Safe Browsing /grant everyone:(f)2⤵PID:3088
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Safe Browsing3⤵PID:5012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache /grant everyone:(f)2⤵PID:1556
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache3⤵PID:3452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache /grant everyone:(f)2⤵PID:1660
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache3⤵PID:4908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen /grant everyone:(f)2⤵PID:4876
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen3⤵PID:468
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local /grant everyone:(f)2⤵PID:4020
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local3⤵PID:3156
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Speech Recognition && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Speech Recognition /grant everyone:(f)2⤵PID:4860
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Speech Recognition3⤵PID:4240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter /grant everyone:(f)2⤵PID:2152
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter3⤵PID:4300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules /grant everyone:(f)2⤵PID:4592
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules3⤵PID:440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists /grant everyone:(f)2⤵PID:4004
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists3⤵PID:3164
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WidevineCdm && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WidevineCdm /grant everyone:(f)2⤵PID:4092
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WidevineCdm3⤵PID:4404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData /grant everyone:(f)2⤵PID:3696
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData3⤵PID:2120
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds /grant everyone:(f)2⤵PID:4044
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds3⤵PID:4532
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\Feeds /grant everyone:(f)3⤵PID:4800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache /grant everyone:(f)2⤵PID:4780
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache3⤵
- Modifies file permissions
PID:1620
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\GameDVR && icacls C:\Users\Admin\AppData\Local\Microsoft\GameDVR /grant everyone:(f)2⤵PID:4692
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\GameDVR3⤵PID:1624
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\GameDVR /grant everyone:(f)3⤵PID:1696
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input && icacls C:\Users\Admin\AppData\Local\Microsoft\input /grant everyone:(f)2⤵PID:1900
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input3⤵PID:4472
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input /grant everyone:(f)3⤵PID:2920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\af-ZA && icacls C:\Users\Admin\AppData\Local\Microsoft\input\af-ZA /grant everyone:(f)2⤵PID:4268
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\af-ZA3⤵PID:3588
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\af-ZA /grant everyone:(f)3⤵PID:4620
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-AE && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-AE /grant everyone:(f)2⤵PID:1028
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-AE3⤵PID:2092
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-AE /grant everyone:(f)3⤵PID:4316
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-BH && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-BH /grant everyone:(f)2⤵PID:5044
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-BH3⤵PID:2888
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-BH /grant everyone:(f)3⤵PID:3488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-DZ && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-DZ /grant everyone:(f)2⤵PID:3948
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-DZ3⤵PID:2592
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-DZ /grant everyone:(f)3⤵
- Possible privilege escalation attempt
PID:3120
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-EG && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-EG /grant everyone:(f)2⤵PID:2252
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-EG3⤵PID:4360
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-EG /grant everyone:(f)3⤵PID:3364
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-IQ && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-IQ /grant everyone:(f)2⤵PID:2360
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-IQ3⤵PID:2456
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-IQ /grant everyone:(f)3⤵PID:4776
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-JO && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-JO /grant everyone:(f)2⤵PID:2420
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-JO3⤵PID:3640
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-JO /grant everyone:(f)3⤵PID:4908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-KW && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-KW /grant everyone:(f)2⤵PID:840
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-KW3⤵PID:1864
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-KW /grant everyone:(f)3⤵PID:4876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-LB && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-LB /grant everyone:(f)2⤵PID:468
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-LB3⤵PID:4020
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-LB /grant everyone:(f)3⤵PID:1768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-LY && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-LY /grant everyone:(f)2⤵PID:3752
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-LY3⤵PID:1516
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-LY /grant everyone:(f)3⤵PID:2068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-MA && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-MA /grant everyone:(f)2⤵PID:8
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-MA3⤵PID:3380
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-MA /grant everyone:(f)3⤵PID:440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-OM && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-OM /grant everyone:(f)2⤵PID:5112
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-OM3⤵
- Modifies file permissions
PID:1924
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-OM /grant everyone:(f)3⤵PID:2472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-QA && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-QA /grant everyone:(f)2⤵PID:5072
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-QA3⤵PID:532
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-QA /grant everyone:(f)3⤵PID:1656
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-SA && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-SA /grant everyone:(f)2⤵PID:448
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-SA3⤵PID:3696
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-SA /grant everyone:(f)3⤵PID:2732
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-SY && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-SY /grant everyone:(f)2⤵PID:2964
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-SY3⤵PID:4016
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-SY /grant everyone:(f)3⤵PID:1652
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-TN && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-TN /grant everyone:(f)2⤵PID:3056
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-TN3⤵PID:324
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-TN /grant everyone:(f)3⤵PID:4992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-YE && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-YE /grant everyone:(f)2⤵PID:4456
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ar-YE3⤵PID:4256
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ar-YE /grant everyone:(f)3⤵PID:2372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\az-Latn-AZ && icacls C:\Users\Admin\AppData\Local\Microsoft\input\az-Latn-AZ /grant everyone:(f)2⤵PID:1900
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\az-Latn-AZ3⤵PID:4140
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\az-Latn-AZ /grant everyone:(f)3⤵PID:4260
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\bg-BG && icacls C:\Users\Admin\AppData\Local\Microsoft\input\bg-BG /grant everyone:(f)2⤵PID:3588
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\bg-BG3⤵PID:4500
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\bg-BG /grant everyone:(f)3⤵PID:232
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\bn-BD && icacls C:\Users\Admin\AppData\Local\Microsoft\input\bn-BD /grant everyone:(f)2⤵PID:2092
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\bn-BD3⤵
- Possible privilege escalation attempt
PID:216
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\bn-BD /grant everyone:(f)3⤵PID:3444
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ca-ES && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ca-ES /grant everyone:(f)2⤵PID:1728
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ca-ES3⤵PID:404
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ca-ES /grant everyone:(f)3⤵PID:3888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\cs-CZ && icacls C:\Users\Admin\AppData\Local\Microsoft\input\cs-CZ /grant everyone:(f)2⤵PID:4900
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\cs-CZ3⤵PID:4844
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\cs-CZ /grant everyone:(f)3⤵PID:2916
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\da-DK && icacls C:\Users\Admin\AppData\Local\Microsoft\input\da-DK /grant everyone:(f)2⤵PID:3832
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\da-DK3⤵PID:3200
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\da-DK /grant everyone:(f)3⤵PID:1312
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\de-AT && icacls C:\Users\Admin\AppData\Local\Microsoft\input\de-AT /grant everyone:(f)2⤵PID:3132
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\de-AT3⤵PID:3936
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\de-AT /grant everyone:(f)3⤵PID:4700
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\de-CH && icacls C:\Users\Admin\AppData\Local\Microsoft\input\de-CH /grant everyone:(f)2⤵PID:3372
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\de-CH3⤵PID:3508
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\de-CH /grant everyone:(f)3⤵PID:2640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\de-DE && icacls C:\Users\Admin\AppData\Local\Microsoft\input\de-DE /grant everyone:(f)2⤵PID:2452
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\de-DE3⤵PID:3680
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\de-DE /grant everyone:(f)3⤵
- Modifies file permissions
PID:3792
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\de-LI && icacls C:\Users\Admin\AppData\Local\Microsoft\input\de-LI /grant everyone:(f)2⤵PID:4244
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\de-LI3⤵PID:4484
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\de-LI /grant everyone:(f)3⤵PID:1768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\de-LU && icacls C:\Users\Admin\AppData\Local\Microsoft\input\de-LU /grant everyone:(f)2⤵PID:4284
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\de-LU3⤵PID:3448
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\de-LU /grant everyone:(f)3⤵PID:336
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\el-GR && icacls C:\Users\Admin\AppData\Local\Microsoft\input\el-GR /grant everyone:(f)2⤵PID:3520
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\el-GR3⤵PID:2152
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\el-GR /grant everyone:(f)3⤵PID:2196
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-029 && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-029 /grant everyone:(f)2⤵PID:1924
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-0293⤵PID:1380
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-029 /grant everyone:(f)3⤵PID:2816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-AU && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-AU /grant everyone:(f)2⤵PID:1656
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-AU3⤵PID:1724
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-AU /grant everyone:(f)3⤵PID:4808
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-BZ && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-BZ /grant everyone:(f)2⤵PID:3732
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-BZ3⤵PID:4136
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-BZ /grant everyone:(f)3⤵PID:2032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-CA && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-CA /grant everyone:(f)2⤵PID:920
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-CA3⤵PID:4016
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-CA /grant everyone:(f)3⤵PID:1036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-GB && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-GB /grant everyone:(f)2⤵PID:4464
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-GB3⤵PID:3840
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-GB /grant everyone:(f)3⤵PID:4848
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-HK && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-HK /grant everyone:(f)2⤵PID:2920
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-HK3⤵PID:4456
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-HK /grant everyone:(f)3⤵
- Modifies file permissions
PID:4060
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-ID && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-ID /grant everyone:(f)2⤵PID:1164
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-ID3⤵
- Possible privilege escalation attempt
PID:544
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-ID /grant everyone:(f)3⤵PID:4752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-IE && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-IE /grant everyone:(f)2⤵PID:2932
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-IE3⤵PID:452
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-IE /grant everyone:(f)3⤵PID:4356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-IN && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-IN /grant everyone:(f)2⤵PID:3992
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-IN3⤵PID:2268
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-IN /grant everyone:(f)3⤵PID:952
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-JM && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-JM /grant everyone:(f)2⤵PID:4144
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-JM3⤵PID:2888
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-JM /grant everyone:(f)3⤵PID:1532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-MY && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-MY /grant everyone:(f)2⤵PID:1352
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-MY3⤵PID:4900
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-MY /grant everyone:(f)3⤵PID:3120
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-NZ && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-NZ /grant everyone:(f)2⤵PID:1616
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-NZ3⤵PID:4360
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-NZ /grant everyone:(f)3⤵PID:3476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-SG && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-SG /grant everyone:(f)2⤵PID:3936
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-SG3⤵PID:4920
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-SG /grant everyone:(f)3⤵PID:4908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-TT && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-TT /grant everyone:(f)2⤵PID:1936
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-TT3⤵PID:5116
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-TT /grant everyone:(f)3⤵PID:4960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-ZA && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-ZA /grant everyone:(f)2⤵PID:3680
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-ZA3⤵PID:4876
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-ZA /grant everyone:(f)3⤵PID:3512
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-ZW && icacls C:\Users\Admin\AppData\Local\Microsoft\input\en-ZW /grant everyone:(f)2⤵PID:3712
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\en-ZW3⤵PID:1912
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\en-ZW /grant everyone:(f)3⤵PID:732
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-419 && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-419 /grant everyone:(f)2⤵PID:2412
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-4193⤵PID:4608
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-419 /grant everyone:(f)3⤵PID:208
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-AR && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-AR /grant everyone:(f)2⤵PID:4428
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-AR3⤵PID:2152
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-AR /grant everyone:(f)3⤵PID:3716
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-BO && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-BO /grant everyone:(f)2⤵PID:3568
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-BO3⤵PID:396
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-BO /grant everyone:(f)3⤵PID:2356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-CL && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-CL /grant everyone:(f)2⤵PID:1724
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-CL3⤵PID:1968
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-CL /grant everyone:(f)3⤵PID:4404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-CO && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-CO /grant everyone:(f)2⤵PID:1200
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-CO3⤵PID:4280
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-CO /grant everyone:(f)3⤵PID:2244
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-CR && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-CR /grant everyone:(f)2⤵PID:1624
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-CR3⤵PID:1036
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-CR /grant everyone:(f)3⤵PID:324
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-DO && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-DO /grant everyone:(f)2⤵PID:4692
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-DO3⤵PID:4884
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-DO /grant everyone:(f)3⤵PID:1888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-EC && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-EC /grant everyone:(f)2⤵PID:3952
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-EC3⤵PID:3460
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-EC /grant everyone:(f)3⤵PID:2540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-ES && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-ES /grant everyone:(f)2⤵PID:1900
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-ES3⤵PID:4604
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-ES /grant everyone:(f)3⤵PID:4028
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-GT && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-GT /grant everyone:(f)2⤵PID:936
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-GT3⤵PID:228
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-GT /grant everyone:(f)3⤵PID:4944
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-HN && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-HN /grant everyone:(f)2⤵PID:2268
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-HN3⤵PID:2592
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-HN /grant everyone:(f)3⤵PID:5060
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-MX && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-MX /grant everyone:(f)2⤵PID:916
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-MX3⤵PID:2348
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-MX /grant everyone:(f)3⤵PID:2184
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-NI && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-NI /grant everyone:(f)2⤵PID:3120
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-NI3⤵PID:5012
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-NI /grant everyone:(f)3⤵PID:4360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-PA && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-PA /grant everyone:(f)2⤵PID:1392
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-PA3⤵PID:3088
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-PA /grant everyone:(f)3⤵PID:4700
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-PE && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-PE /grant everyone:(f)2⤵PID:4908
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-PE3⤵PID:2420
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-PE /grant everyone:(f)3⤵PID:3508
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-PR && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-PR /grant everyone:(f)2⤵PID:3452
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-PR3⤵PID:4452
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-PR /grant everyone:(f)3⤵PID:3156
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-PY && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-PY /grant everyone:(f)2⤵PID:1424
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-PY3⤵PID:4020
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-PY /grant everyone:(f)3⤵PID:2068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-SV && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-SV /grant everyone:(f)2⤵PID:4336
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-SV3⤵PID:4180
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-SV /grant everyone:(f)3⤵PID:3608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-US && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-US /grant everyone:(f)2⤵PID:2412
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-US3⤵PID:2468
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-US /grant everyone:(f)3⤵PID:2152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-UY && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-UY /grant everyone:(f)2⤵PID:3380
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-UY3⤵PID:532
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-UY /grant everyone:(f)3⤵PID:2472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-VE && icacls C:\Users\Admin\AppData\Local\Microsoft\input\es-VE /grant everyone:(f)2⤵PID:2356
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\es-VE3⤵PID:5072
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\es-VE /grant everyone:(f)3⤵PID:2320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\et-EE && icacls C:\Users\Admin\AppData\Local\Microsoft\input\et-EE /grant everyone:(f)2⤵PID:3160
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\et-EE3⤵PID:1968
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\et-EE /grant everyone:(f)3⤵PID:3748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\eu-ES && icacls C:\Users\Admin\AppData\Local\Microsoft\input\eu-ES /grant everyone:(f)2⤵PID:540
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\eu-ES3⤵PID:2244
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\eu-ES /grant everyone:(f)3⤵
- Possible privilege escalation attempt
PID:3416
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fa-IR && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fa-IR /grant everyone:(f)2⤵PID:760
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fa-IR3⤵PID:1036
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fa-IR /grant everyone:(f)3⤵PID:704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fi-FI && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fi-FI /grant everyone:(f)2⤵PID:2416
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fi-FI3⤵PID:4200
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fi-FI /grant everyone:(f)3⤵PID:812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-029 && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-029 /grant everyone:(f)2⤵PID:4760
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-0293⤵PID:3460
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-029 /grant everyone:(f)3⤵PID:3220
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-BE && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-BE /grant everyone:(f)2⤵PID:644
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-BE3⤵PID:4140
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-BE /grant everyone:(f)3⤵PID:4500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-CA && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-CA /grant everyone:(f)2⤵PID:3444
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-CA3⤵PID:4708
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-CA /grant everyone:(f)3⤵PID:2012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-CD && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-CD /grant everyone:(f)2⤵PID:1728
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-CD3⤵PID:1028
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-CD /grant everyone:(f)3⤵PID:4144
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-CH && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-CH /grant everyone:(f)2⤵PID:1940
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-CH3⤵PID:404
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-CH /grant everyone:(f)3⤵PID:1932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-CI && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-CI /grant everyone:(f)2⤵PID:3516
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-CI3⤵PID:4716
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-CI /grant everyone:(f)3⤵PID:3476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-CM && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-CM /grant everyone:(f)2⤵PID:556
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-CM3⤵PID:3088
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-CM /grant everyone:(f)3⤵PID:3132
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-FR && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-FR /grant everyone:(f)2⤵PID:1640
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-FR3⤵PID:2528
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-FR /grant everyone:(f)3⤵PID:4524
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-HT && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-HT /grant everyone:(f)2⤵PID:4876
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-HT3⤵PID:3728
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-HT /grant everyone:(f)3⤵PID:3156
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-LU && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-LU /grant everyone:(f)2⤵PID:3932
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-LU3⤵PID:5076
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-LU /grant everyone:(f)3⤵PID:4248
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-MA && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-MA /grant everyone:(f)2⤵PID:2004
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-MA3⤵PID:2256
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-MA /grant everyone:(f)3⤵PID:1912
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-MC && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-MC /grant everyone:(f)2⤵PID:8
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-MC3⤵PID:3752
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-MC /grant everyone:(f)3⤵PID:4396
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-ML && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-ML /grant everyone:(f)2⤵PID:2152
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-ML3⤵PID:2816
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-ML /grant everyone:(f)3⤵PID:3380
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-RE && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-RE /grant everyone:(f)2⤵PID:396
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-RE3⤵PID:3048
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-RE /grant everyone:(f)3⤵PID:1032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-SN && icacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-SN /grant everyone:(f)2⤵PID:4136
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\fr-SN3⤵PID:4964
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\fr-SN /grant everyone:(f)3⤵PID:1676
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\gl-ES && icacls C:\Users\Admin\AppData\Local\Microsoft\input\gl-ES /grant everyone:(f)2⤵PID:764
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\gl-ES3⤵PID:4932
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\gl-ES /grant everyone:(f)3⤵PID:3212
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ha-Latn-NG && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ha-Latn-NG /grant everyone:(f)2⤵PID:1036
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ha-Latn-NG3⤵PID:1624
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ha-Latn-NG /grant everyone:(f)3⤵PID:4464
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\he-IL && icacls C:\Users\Admin\AppData\Local\Microsoft\input\he-IL /grant everyone:(f)2⤵PID:376
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\he-IL3⤵PID:4692
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\he-IL /grant everyone:(f)3⤵PID:4256
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\hi-IN && icacls C:\Users\Admin\AppData\Local\Microsoft\input\hi-IN /grant everyone:(f)2⤵PID:4600
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\hi-IN3⤵PID:2920
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\hi-IN /grant everyone:(f)3⤵PID:4604
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\hr-BA && icacls C:\Users\Admin\AppData\Local\Microsoft\input\hr-BA /grant everyone:(f)2⤵PID:4140
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\hr-BA3⤵PID:452
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\hr-BA /grant everyone:(f)3⤵PID:4944
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\hr-HR && icacls C:\Users\Admin\AppData\Local\Microsoft\input\hr-HR /grant everyone:(f)2⤵PID:3588
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\hr-HR3⤵PID:1044
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\hr-HR /grant everyone:(f)3⤵
- Possible privilege escalation attempt
PID:4552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\hu-HU && icacls C:\Users\Admin\AppData\Local\Microsoft\input\hu-HU /grant everyone:(f)2⤵PID:1560
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\hu-HU3⤵PID:1784
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\hu-HU /grant everyone:(f)3⤵PID:2348
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\hy-AM && icacls C:\Users\Admin\AppData\Local\Microsoft\input\hy-AM /grant everyone:(f)2⤵PID:404
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\hy-AM3⤵PID:5056
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\hy-AM /grant everyone:(f)3⤵PID:2140
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\id-ID && icacls C:\Users\Admin\AppData\Local\Microsoft\input\id-ID /grant everyone:(f)2⤵PID:2684
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\id-ID3⤵PID:4360
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\id-ID /grant everyone:(f)3⤵PID:3472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\it-CH && icacls C:\Users\Admin\AppData\Local\Microsoft\input\it-CH /grant everyone:(f)2⤵PID:3088
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\it-CH3⤵PID:2236
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\it-CH /grant everyone:(f)3⤵PID:2360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\it-IT && icacls C:\Users\Admin\AppData\Local\Microsoft\input\it-IT /grant everyone:(f)2⤵PID:3968
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\it-IT3⤵PID:2892
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\it-IT /grant everyone:(f)3⤵
- Modifies file permissions
PID:5116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ka-GE && icacls C:\Users\Admin\AppData\Local\Microsoft\input\ka-GE /grant everyone:(f)2⤵PID:3728
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\ka-GE3⤵PID:3512
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\ka-GE /grant everyone:(f)3⤵PID:4372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\kk-KZ && icacls C:\Users\Admin\AppData\Local\Microsoft\input\kk-KZ /grant everyone:(f)2⤵PID:3792
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\kk-KZ3⤵PID:1768
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\kk-KZ /grant everyone:(f)3⤵PID:4336
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\input\lt-LT && icacls C:\Users\Admin\AppData\Local\Microsoft\input\lt-LT /grant everyone:(f)2⤵PID:732
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Microsoft\input\lt-LT3⤵PID:1988
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Microsoft\input\lt-LT /grant everyone:(f)3⤵PID:2168
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1