087315508cc43b632dae4750608cf107dfd454e2beacb03eeb4b43d013906d3d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

target.vbs
Size

828B
MD5

333ac8009978dfe4bc0e7ea72ad31289
SHA1

a8bc098f840e1b0faadb82d1087cf571e979a80d
SHA256

087315508cc43b632dae4750608cf107dfd454e2beacb03eeb4b43d013906d3d
SHA512

9a3886771f4b12576d9e155077b968b63932689a42e31e2d32642d6a9a46030e2157ea4da58bfddae5a6b37200174a990095e6f9776411a59f8b302fb7a42f9d

Score

9^/10

credential_access discovery exploit ransomware spyware stealer

Malware Config

Signatures

Renames multiple (869) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
2424	takeown.exe
2712	takeown.exe
2080	takeown.exe
2064	Process not Found
2448	Process not Found
2776	Process not Found
2952	takeown.exe
2196	takeown.exe
2116	takeown.exe
1344	Process not Found
1764	Process not Found
3016	Process not Found
696	icacls.exe
2440	takeown.exe
2220	icacls.exe
2612	takeown.exe
2328	takeown.exe
1812	icacls.exe
2860	Process not Found
2092	icacls.exe
2152	Process not Found
2744	icacls.exe
700	Process not Found
2760	takeown.exe
2896	Process not Found
2424	Process not Found
2464	Process not Found
2936	icacls.exe
2940	icacls.exe
2064	Process not Found
1684	icacls.exe
3064	Process not Found
2824	Process not Found
2388	takeown.exe
264	Process not Found
1224	Process not Found
684	Process not Found
1668	icacls.exe
2284	Process not Found
2840	icacls.exe
1752	takeown.exe
2656	Process not Found
924	takeown.exe
2444	takeown.exe
2920	takeown.exe
3020	icacls.exe
2740	icacls.exe
2980	takeown.exe
648	takeown.exe
1224	Process not Found
2104	takeown.exe
2728	Process not Found
3008	Process not Found
1520	Process not Found
1620	Process not Found
2884	takeown.exe
3040	takeown.exe
1976	takeown.exe
2932	takeown.exe
1736	takeown.exe
1068	icacls.exe
2672	icacls.exe
2952	Process not Found
1308	takeown.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1308	takeown.exe
1064	takeown.exe
2936	Process not Found
1788	Process not Found
1344	Process not Found
1120	icacls.exe
1680	Process not Found
2016	takeown.exe
2812	takeown.exe
2360	icacls.exe
1032	Process not Found
2532	icacls.exe
2440	icacls.exe
1644	takeown.exe
1960	takeown.exe
2776	takeown.exe
2768	icacls.exe
2716	takeown.exe
2076	takeown.exe
2376	icacls.exe
1916	Process not Found
2192	Process not Found
1680	takeown.exe
1644	icacls.exe
1584	icacls.exe
2864	Process not Found
1908	Process not Found
1988	Process not Found
2532	takeown.exe
2156	takeown.exe
3044	Process not Found
548	takeown.exe
2920	icacls.exe
352	Process not Found
1044	Process not Found
1624	icacls.exe
2164	Process not Found
2920	Process not Found
2776	takeown.exe
816	takeown.exe
2080	takeown.exe
2092	icacls.exe
1000	Process not Found
2076	takeown.exe
1968	takeown.exe
1668	takeown.exe
2520	takeown.exe
2372	takeown.exe
1648	takeown.exe
2856	Process not Found
2392	Process not Found
1668	takeown.exe
2544	takeown.exe
1600	Process not Found
1608	Process not Found
2840	Process not Found
1232	takeown.exe
2392	icacls.exe
2980	Process not Found
2784	takeown.exe
880	Process not Found
1520	takeown.exe
2936	icacls.exe
2188	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1568	cmd.exe
852	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2960	WScript.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2960	WScript.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2388	2960	WScript.exe	30
PID 2960 wrote to memory of 2388	2960	WScript.exe	30
PID 2960 wrote to memory of 2388	2960	WScript.exe	30
PID 2388 wrote to memory of 2548	2388	cmd.exe	32
PID 2388 wrote to memory of 2548	2388	cmd.exe	32
PID 2388 wrote to memory of 2548	2388	cmd.exe	32
PID 2388 wrote to memory of 2512	2388	cmd.exe	33
PID 2388 wrote to memory of 2512	2388	cmd.exe	33
PID 2388 wrote to memory of 2512	2388	cmd.exe	33
PID 2960 wrote to memory of 2524	2960	WScript.exe	34
PID 2960 wrote to memory of 2524	2960	WScript.exe	34
PID 2960 wrote to memory of 2524	2960	WScript.exe	34
PID 2524 wrote to memory of 1736	2524	cmd.exe	36
PID 2524 wrote to memory of 1736	2524	cmd.exe	36
PID 2524 wrote to memory of 1736	2524	cmd.exe	36
PID 2524 wrote to memory of 1868	2524	cmd.exe	37
PID 2524 wrote to memory of 1868	2524	cmd.exe	37
PID 2524 wrote to memory of 1868	2524	cmd.exe	37
PID 2960 wrote to memory of 2336	2960	WScript.exe	38
PID 2960 wrote to memory of 2336	2960	WScript.exe	38
PID 2960 wrote to memory of 2336	2960	WScript.exe	38
PID 2336 wrote to memory of 2224	2336	cmd.exe	40
PID 2336 wrote to memory of 2224	2336	cmd.exe	40
PID 2336 wrote to memory of 2224	2336	cmd.exe	40
PID 2336 wrote to memory of 2692	2336	cmd.exe	41
PID 2336 wrote to memory of 2692	2336	cmd.exe	41
PID 2336 wrote to memory of 2692	2336	cmd.exe	41
PID 2960 wrote to memory of 2204	2960	WScript.exe	42
PID 2960 wrote to memory of 2204	2960	WScript.exe	42
PID 2960 wrote to memory of 2204	2960	WScript.exe	42
PID 2204 wrote to memory of 2744	2204	cmd.exe	44
PID 2204 wrote to memory of 2744	2204	cmd.exe	44
PID 2204 wrote to memory of 2744	2204	cmd.exe	44
PID 2204 wrote to memory of 2752	2204	cmd.exe	45
PID 2204 wrote to memory of 2752	2204	cmd.exe	45
PID 2204 wrote to memory of 2752	2204	cmd.exe	45
PID 2960 wrote to memory of 2812	2960	WScript.exe	46
PID 2960 wrote to memory of 2812	2960	WScript.exe	46
PID 2960 wrote to memory of 2812	2960	WScript.exe	46
PID 2812 wrote to memory of 2824	2812	cmd.exe	48
PID 2812 wrote to memory of 2824	2812	cmd.exe	48
PID 2812 wrote to memory of 2824	2812	cmd.exe	48
PID 2812 wrote to memory of 2800	2812	cmd.exe	49
PID 2812 wrote to memory of 2800	2812	cmd.exe	49
PID 2812 wrote to memory of 2800	2812	cmd.exe	49
PID 2960 wrote to memory of 2736	2960	WScript.exe	50
PID 2960 wrote to memory of 2736	2960	WScript.exe	50
PID 2960 wrote to memory of 2736	2960	WScript.exe	50
PID 2736 wrote to memory of 2720	2736	cmd.exe	52
PID 2736 wrote to memory of 2720	2736	cmd.exe	52
PID 2736 wrote to memory of 2720	2736	cmd.exe	52
PID 2736 wrote to memory of 1632	2736	cmd.exe	53
PID 2736 wrote to memory of 1632	2736	cmd.exe	53
PID 2736 wrote to memory of 1632	2736	cmd.exe	53
PID 2960 wrote to memory of 2856	2960	WScript.exe	54
PID 2960 wrote to memory of 2856	2960	WScript.exe	54
PID 2960 wrote to memory of 2856	2960	WScript.exe	54
PID 2856 wrote to memory of 2832	2856	cmd.exe	56
PID 2856 wrote to memory of 2832	2856	cmd.exe	56
PID 2856 wrote to memory of 2832	2856	cmd.exe	56
PID 2856 wrote to memory of 2836	2856	cmd.exe	57
PID 2856 wrote to memory of 2836	2856	cmd.exe	57
PID 2856 wrote to memory of 2836	2856	cmd.exe	57
PID 2960 wrote to memory of 2768	2960	WScript.exe	58

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\target.vbs"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\ && icacls C:\Users\ /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\
    3⤵
    PID:2548
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\ /grant everyone:(f)
    3⤵
    PID:2512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin && icacls C:\Users\Admin /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin
    3⤵
    PID:1736
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin /grant everyone:(f)
    3⤵
    PID:1868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData && icacls C:\Users\Admin\AppData /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData
    3⤵
    PID:2224
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData /grant everyone:(f)
    3⤵
    PID:2692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local && icacls C:\Users\Admin\AppData\Local /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local
    3⤵
    PID:2744
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local /grant everyone:(f)
    3⤵
    PID:2752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe && icacls C:\Users\Admin\AppData\Local\Adobe /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe
    3⤵
    PID:2824
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe /grant everyone:(f)
    3⤵
    PID:2800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat
    3⤵
    PID:2720
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat /grant everyone:(f)
    3⤵
    PID:1632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0 && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0 /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0
    3⤵
    PID:2832
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0 /grant everyone:(f)
    3⤵
    PID:2836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache && icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache /grant everyone:(f)
  2⤵
  PID:2768
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache
    3⤵
    PID:2792
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache /grant everyone:(f)
    3⤵
    PID:1168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Color && icacls C:\Users\Admin\AppData\Local\Adobe\Color /grant everyone:(f)
  2⤵
  PID:2596
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Color
    3⤵
    PID:2664
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Color /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles && icacls C:\Users\Admin\AppData\Local\Adobe\Color\Profiles /grant everyone:(f)
  2⤵
  PID:2084
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles
    3⤵
    - Possible privilege escalation attempt
    PID:2424
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Adobe\Color\Profiles /grant everyone:(f)
    3⤵
    PID:2180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Application Data && icacls C:\Users\Admin\AppData\Local\Application Data /grant everyone:(f)
  2⤵
  PID:684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Application Data
    3⤵
    PID:1572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google && icacls C:\Users\Admin\AppData\Local\Google /grant everyone:(f)
  2⤵
  PID:1492
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google
    3⤵
    PID:484
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Google /grant everyone:(f)
    3⤵
    PID:2848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome /grant everyone:(f)
  2⤵
  PID:1500
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome
    3⤵
    PID:264
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Google\Chrome /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:2440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data /grant everyone:(f)
  2⤵
  PID:1588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data
    3⤵
    PID:1636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates /grant everyone:(f)
  2⤵
  PID:1684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates
    3⤵
    PID:2176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics /grant everyone:(f)
  2⤵
  PID:2916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics
    3⤵
    PID:3056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation /grant everyone:(f)
  2⤵
  PID:2220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation
    3⤵
    - Possible privilege escalation attempt
    PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ClientSidePhishing && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ClientSidePhishing /grant everyone:(f)
  2⤵
  PID:2352
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ClientSidePhishing
    3⤵
    PID:2076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad /grant everyone:(f)
  2⤵
  PID:2164
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad
    3⤵
    PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments /grant everyone:(f)
  2⤵
  PID:1760
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments
    3⤵
    PID:1096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports /grant everyone:(f)
  2⤵
  PID:1152
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports
    3⤵
    PID:3000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny /grant everyone:(f)
  2⤵
  PID:904
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny
    3⤵
    - Possible privilege escalation attempt
    PID:924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default /grant everyone:(f)
  2⤵
  PID:2140
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
    3⤵
    PID:2296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase /grant everyone:(f)
  2⤵
  PID:1716
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
    3⤵
    PID:1600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage /grant everyone:(f)
  2⤵
  PID:1000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage
    3⤵
    PID:864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\467b9bf5-1ebb-4f4a-abc5-b052e8ad1b21 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\467b9bf5-1ebb-4f4a-abc5-b052e8ad1b21 /grant everyone:(f)
  2⤵
  PID:1316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\467b9bf5-1ebb-4f4a-abc5-b052e8ad1b21
    3⤵
    PID:2312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase /grant everyone:(f)
  2⤵
  PID:2080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
    3⤵
    PID:2276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache /grant everyone:(f)
  2⤵
  PID:3036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache
    3⤵
    PID:2072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data /grant everyone:(f)
  2⤵
  PID:892
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data
    3⤵
    PID:1292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache /grant everyone:(f)
  2⤵
  PID:1664
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache
    3⤵
    PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js /grant everyone:(f)
  2⤵
  PID:2332
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
    3⤵
    PID:1616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir /grant everyone:(f)
  2⤵
  PID:2380
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
    3⤵
    - Possible privilege escalation attempt
    PID:2104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm /grant everyone:(f)
  2⤵
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
    3⤵
    PID:1252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir /grant everyone:(f)
  2⤵
  PID:1592
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
    3⤵
    PID:2524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db /grant everyone:(f)
  2⤵
  PID:2208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
    3⤵
    PID:1960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db /grant everyone:(f)
  2⤵
  PID:2336
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db
    3⤵
    PID:2796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache /grant everyone:(f)
  2⤵
  PID:2464
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache
    3⤵
    PID:2984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service /grant everyone:(f)
  2⤵
  PID:2748
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service
    3⤵
    PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB /grant everyone:(f)
  2⤵
  PID:2764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
    3⤵
    PID:2608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files /grant everyone:(f)
  2⤵
  PID:1648
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
    3⤵
    PID:2168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts /grant everyone:(f)
  2⤵
  PID:2624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
    3⤵
    - Modifies file permissions
    PID:2776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State /grant everyone:(f)
  2⤵
  PID:2828
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State
    3⤵
    PID:2648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker /grant everyone:(f)
  2⤵
  PID:2620
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
    3⤵
    PID:2644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB /grant everyone:(f)
  2⤵
  PID:2632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
    3⤵
    PID:2304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB /grant everyone:(f)
  2⤵
  PID:1936
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
    3⤵
    PID:920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store /grant everyone:(f)
  2⤵
  PID:1144
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store
    3⤵
    PID:1052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption /grant everyone:(f)
  2⤵
  PID:2004
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
    3⤵
    PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache /grant everyone:(f)
  2⤵
  PID:536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache
    3⤵
    PID:2440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage /grant everyone:(f)
  2⤵
  PID:1500
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage
    3⤵
    PID:1636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb /grant everyone:(f)
  2⤵
  PID:1588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
    3⤵
    PID:2176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network /grant everyone:(f)
  2⤵
  PID:1684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network
    3⤵
    PID:3056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store /grant everyone:(f)
  2⤵
  PID:2916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
    3⤵
    PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store /grant everyone:(f)
  2⤵
  PID:2220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
    3⤵
    - Modifies file permissions
    PID:2076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network /grant everyone:(f)
  2⤵
  PID:2352
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network
    3⤵
    PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform /grant everyone:(f)
  2⤵
  PID:2164
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
    3⤵
    PID:1096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB /grant everyone:(f)
  2⤵
  PID:1760
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
    3⤵
    PID:3000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB /grant everyone:(f)
  2⤵
  PID:1624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
    3⤵
    PID:308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB /grant everyone:(f)
  2⤵
  PID:1920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
    3⤵
    PID:1708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage /grant everyone:(f)
  2⤵
  PID:3044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage
    3⤵
    PID:1356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions /grant everyone:(f)
  2⤵
  PID:1380
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions
    3⤵
    PID:1384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db /grant everyone:(f)
  2⤵
  PID:3052
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
    3⤵
    PID:864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata /grant everyone:(f)
  2⤵
  PID:2252
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
    3⤵
    PID:2312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database /grant everyone:(f)
  2⤵
  PID:1316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
    3⤵
    PID:2068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data /grant everyone:(f)
  2⤵
  PID:2200
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data
    3⤵
    PID:2148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB /grant everyone:(f)
  2⤵
  PID:2056
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
    3⤵
    - Possible privilege escalation attempt
    PID:2444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications /grant everyone:(f)
  2⤵
  PID:1044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications
    3⤵
    PID:2404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources /grant everyone:(f)
  2⤵
  PID:2416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
    3⤵
    PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak /grant everyone:(f)
  2⤵
  PID:1620
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak
    3⤵
    PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons /grant everyone:(f)
  2⤵
  PID:2512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons
    3⤵
    PID:2400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable /grant everyone:(f)
  2⤵
  PID:1736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable
    3⤵
    PID:2392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml /grant everyone:(f)
  2⤵
  PID:2348
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml
    3⤵
    PID:1948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons /grant everyone:(f)
  2⤵
  PID:2752
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons
    3⤵
    PID:2060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable /grant everyone:(f)
  2⤵
  PID:2824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable
    3⤵
    PID:2972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2728
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome
    3⤵
    PID:2844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf /grant everyone:(f)
  2⤵
  PID:2736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf
    3⤵
    PID:2636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons /grant everyone:(f)
  2⤵
  PID:2740
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons
    3⤵
    PID:1648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable /grant everyone:(f)
  2⤵
  PID:2656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable
    3⤵
    PID:2856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2868
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome
    3⤵
    PID:1168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm /grant everyone:(f)
  2⤵
  PID:2612
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm
    3⤵
    PID:2664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons /grant everyone:(f)
  2⤵
  PID:1068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons
    3⤵
    PID:816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable /grant everyone:(f)
  2⤵
  PID:1764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable
    3⤵
    PID:2084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome
    3⤵
    PID:684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag /grant everyone:(f)
  2⤵
  PID:1652
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag
    3⤵
    PID:2848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons /grant everyone:(f)
  2⤵
  PID:700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons
    3⤵
    PID:800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable /grant everyone:(f)
  2⤵
  PID:1968
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable
    3⤵
    - Possible privilege escalation attempt
    PID:2884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:2944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome
    3⤵
    PID:1588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb /grant everyone:(f)
  2⤵
  PID:2912
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb
    3⤵
    - Possible privilege escalation attempt
    PID:2920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons /grant everyone:(f)
  2⤵
  PID:2184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons
    3⤵
    PID:2924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable /grant everyone:(f)
  2⤵
  PID:2144
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable
    3⤵
    PID:2196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome /grant everyone:(f)
  2⤵
  PID:1796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome
    3⤵
    PID:2156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp /grant everyone:(f)
  2⤵
  PID:2228
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
    3⤵
    PID:2160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\DesktopSharingHub && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\DesktopSharingHub /grant everyone:(f)
  2⤵
  PID:2996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\DesktopSharingHub
    3⤵
    - Possible privilege escalation attempt
    PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies /grant everyone:(f)
  2⤵
  PID:924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies
    3⤵
    PID:1152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded /grant everyone:(f)
  2⤵
  PID:2296
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded
    3⤵
    PID:1784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FontLookupTableCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FontLookupTableCache /grant everyone:(f)
  2⤵
  PID:1700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FontLookupTableCache
    3⤵
    PID:2140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache /grant everyone:(f)
  2⤵
  PID:1752
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache
    3⤵
    PID:1380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data /grant everyone:(f)
  2⤵
  PID:780
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data
    3⤵
    PID:852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload /grant everyone:(f)
  2⤵
  PID:3016
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload
    3⤵
    PID:1000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel /grant everyone:(f)
  2⤵
  PID:696
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel
    3⤵
    PID:3020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints /grant everyone:(f)
  2⤵
  PID:1928
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints
    3⤵
    PID:1004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials /grant everyone:(f)
  2⤵
  PID:2444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials
    3⤵
    - Modifies file permissions
    PID:1520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata /grant everyone:(f)
  2⤵
  PID:2404
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata
    3⤵
    PID:2236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\pnacl && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\pnacl /grant everyone:(f)
  2⤵
  PID:1064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\pnacl
    3⤵
    PID:2092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved /grant everyone:(f)
  2⤵
  PID:2280
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved
    3⤵
    - Modifies file permissions
    PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips /grant everyone:(f)
  2⤵
  PID:2380
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips
    3⤵
    - Possible privilege escalation attempt
    PID:2388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache /grant everyone:(f)
  2⤵
  PID:2544
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache
    3⤵
    PID:1868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant /grant everyone:(f)
  2⤵
  PID:2528
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant
    3⤵
    PID:2224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter /grant everyone:(f)
  2⤵
  PID:2208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter
    3⤵
    PID:2448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules /grant everyone:(f)
  2⤵
  PID:2744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules
    3⤵
    PID:2204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter /grant everyone:(f)
  2⤵
  PID:2464
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter
    3⤵
    PID:2800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 /grant everyone:(f)
  2⤵
  PID:2748
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64
    3⤵
    PID:2720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\UrlParamClassifications && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\UrlParamClassifications /grant everyone:(f)
  2⤵
  PID:2764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\UrlParamClassifications
    3⤵
    PID:1164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm /grant everyone:(f)
  2⤵
  PID:2376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm
    3⤵
    PID:2888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData && icacls C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData /grant everyone:(f)
  2⤵
  PID:2864
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData
    3⤵
    PID:2600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History && icacls C:\Users\Admin\AppData\Local\History /grant everyone:(f)
  2⤵
  PID:2852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History
    3⤵
    PID:2676
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History /grant everyone:(f)
    3⤵
    PID:2664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\History.IE5 && icacls C:\Users\Admin\AppData\Local\History\History.IE5 /grant everyone:(f)
  2⤵
  PID:2644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History\History.IE5
    3⤵
    PID:2424
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History\History.IE5 /grant everyone:(f)
    3⤵
    PID:2428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024090320240904 && icacls C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024090320240904 /grant everyone:(f)
  2⤵
  PID:3064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024090320240904
    3⤵
    PID:1936
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History\History.IE5\MSHist012024090320240904 /grant everyone:(f)
    3⤵
    PID:1112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\History\Low && icacls C:\Users\Admin\AppData\Local\History\Low /grant everyone:(f)
  2⤵
  PID:2344
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\History\Low
    3⤵
    PID:2700
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\History\Low /grant everyone:(f)
    3⤵
    PID:2848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft && icacls C:\Users\Admin\AppData\Local\Microsoft /grant everyone:(f)
  2⤵
  PID:2004
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft
    3⤵
    PID:2128
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft /grant everyone:(f)
    3⤵
    PID:700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Credentials && icacls C:\Users\Admin\AppData\Local\Microsoft\Credentials /grant everyone:(f)
  2⤵
  PID:1812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Credentials
    3⤵
    PID:1500
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Credentials /grant everyone:(f)
    3⤵
    PID:1660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds /grant everyone:(f)
  2⤵
  PID:1988
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds
    3⤵
    PID:3040
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~ && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~ /grant everyone:(f)
  2⤵
  PID:2912
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~
    3⤵
    PID:2924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~ && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~ /grant everyone:(f)
  2⤵
  PID:2184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~
    3⤵
    - Possible privilege escalation attempt
    PID:2196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~ && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~ /grant everyone:(f)
  2⤵
  PID:2152
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~
    3⤵
    - Modifies file permissions
    PID:2156
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~ /grant everyone:(f)
    3⤵
    PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ /grant everyone:(f)
  2⤵
  PID:2696
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~
    3⤵
    PID:444
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ /grant everyone:(f)
    3⤵
    PID:280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache /grant everyone:(f)
  2⤵
  PID:1552
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache
    3⤵
    PID:1672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FUHIK2RW && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FUHIK2RW /grant everyone:(f)
  2⤵
  PID:1324
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FUHIK2RW
    3⤵
    - Modifies file permissions
    PID:1232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\OM66BHWE && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\OM66BHWE /grant everyone:(f)
  2⤵
  PID:1708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\OM66BHWE
    3⤵
    - Modifies file permissions
    PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Q4438GAN && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Q4438GAN /grant everyone:(f)
  2⤵
  PID:3044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Q4438GAN
    3⤵
    PID:976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\R627XHFP && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\R627XHFP /grant everyone:(f)
  2⤵
  PID:1776
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\R627XHFP
    3⤵
    PID:2248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\SP885UOB && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\SP885UOB /grant everyone:(f)
  2⤵
  PID:864
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\SP885UOB
    3⤵
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U8F4PBMO && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U8F4PBMO /grant everyone:(f)
  2⤵
  PID:2496
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U8F4PBMO
    3⤵
    PID:1680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y7RLQ0C0 && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y7RLQ0C0 /grant everyone:(f)
  2⤵
  PID:1316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y7RLQ0C0
    3⤵
    - Modifies file permissions
    PID:548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YPLB435F && icacls C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YPLB435F /grant everyone:(f)
  2⤵
  PID:3032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YPLB435F
    3⤵
    PID:884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer /grant everyone:(f)
  2⤵
  PID:3036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer
    3⤵
    PID:1032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData /grant everyone:(f)
  2⤵
  PID:2396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData
    3⤵
    PID:1584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore /grant everyone:(f)
  2⤵
  PID:2492
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore
    3⤵
    PID:1724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\anyweax && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\anyweax /grant everyone:(f)
  2⤵
  PID:1608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\anyweax
    3⤵
    PID:1224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery /grant everyone:(f)
  2⤵
  PID:2512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery
    3⤵
    PID:2892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High /grant everyone:(f)
  2⤵
  PID:2384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High
    3⤵
    PID:2088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active /grant everyone:(f)
  2⤵
  PID:2260
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active
    3⤵
    PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active /grant everyone:(f)
  2⤵
  PID:1960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active
    3⤵
    PID:2756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\TabRoaming && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\TabRoaming /grant everyone:(f)
  2⤵
  PID:2796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\TabRoaming
    3⤵
    PID:2452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles /grant everyone:(f)
  2⤵
  PID:2984
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles
    3⤵
    PID:2968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440 && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440 /grant everyone:(f)
  2⤵
  PID:2816
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440
    3⤵
    PID:2836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290 && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290 /grant everyone:(f)
  2⤵
  PID:2688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290
    3⤵
    PID:2792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tracking Protection && icacls C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tracking Protection /grant everyone:(f)
  2⤵
  PID:2168
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tracking Protection
    3⤵
    PID:2604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player && icacls C:\Users\Admin\AppData\Local\Microsoft\Media Player /grant everyone:(f)
  2⤵
  PID:2716
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player
    3⤵
    PID:2596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists && icacls C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists /grant everyone:(f)
  2⤵
  PID:2620
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists
    3⤵
    PID:2852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US && icacls C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US /grant everyone:(f)
  2⤵
  PID:2632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US
    3⤵
    - Modifies file permissions
    PID:816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000582D && icacls C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000582D /grant everyone:(f)
  2⤵
  PID:2644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000582D
    3⤵
    PID:484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office && icacls C:\Users\Admin\AppData\Local\Microsoft\Office /grant everyone:(f)
  2⤵
  PID:920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office
    3⤵
    PID:1976
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Office /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:1120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\14.0 && icacls C:\Users\Admin\AppData\Local\Microsoft\Office\14.0 /grant everyone:(f)
  2⤵
  PID:1144
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\14.0
    3⤵
    PID:2440
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Office\14.0 /grant everyone:(f)
    3⤵
    PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove && icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove /grant everyone:(f)
  2⤵
  PID:1492
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove
    3⤵
    - Modifies file permissions
    PID:1644
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove /grant everyone:(f)
    3⤵
    PID:1916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\System && icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\System /grant everyone:(f)
  2⤵
  PID:1560
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\System
    3⤵
    PID:2116
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\System /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:2920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\User && icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\User /grant everyone:(f)
  2⤵
  PID:2176
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\User
    3⤵
    PID:2640
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\User /grant everyone:(f)
    3⤵
    PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\PlayReady && icacls C:\Users\Admin\AppData\Local\Microsoft\PlayReady /grant everyone:(f)
  2⤵
  PID:2908
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\PlayReady
    3⤵
    PID:2916
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\PlayReady /grant everyone:(f)
    3⤵
    PID:2560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /grant everyone:(f)
  2⤵
  PID:1212
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows
    3⤵
    PID:2064
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /grant everyone:(f)
    3⤵
    PID:2152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn /grant everyone:(f)
  2⤵
  PID:1096
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn
    3⤵
    PID:2988
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn /grant everyone:(f)
    3⤵
    PID:280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn /grant everyone:(f)
  2⤵
  PID:2948
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn
    3⤵
    PID:2980
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn /grant everyone:(f)
    3⤵
    PID:2052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches /grant everyone:(f)
  2⤵
  PID:1784
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
    3⤵
    PID:308
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches /grant everyone:(f)
    3⤵
    PID:1260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer /grant everyone:(f)
  2⤵
  PID:2296
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer
    3⤵
    PID:1380
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer /grant everyone:(f)
    3⤵
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer /grant everyone:(f)
  2⤵
  PID:1356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer
    3⤵
    PID:1716
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer /grant everyone:(f)
    3⤵
    PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History /grant everyone:(f)
  2⤵
  PID:1000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History
    3⤵
    PID:3052
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History /grant everyone:(f)
    3⤵
    PID:3016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5 /grant everyone:(f)
  2⤵
  PID:2364
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5
    3⤵
    PID:1004
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5 /grant everyone:(f)
    3⤵
    PID:2276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012024090320240904 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012024090320240904 /grant everyone:(f)
  2⤵
  PID:2068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012024090320240904
    3⤵
    - Modifies file permissions
    PID:2080
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012024090320240904 /grant everyone:(f)
    3⤵
    PID:2056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low /grant everyone:(f)
  2⤵
  PID:2236
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low
    3⤵
    - Modifies file permissions
    PID:1668
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low /grant everyone:(f)
    3⤵
    PID:1292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones /grant everyone:(f)
  2⤵
  PID:2404
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones
    3⤵
    PID:2532
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones /grant everyone:(f)
    3⤵
    PID:1620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files /grant everyone:(f)
  2⤵
  PID:1664
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files
    3⤵
    PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 /grant everyone:(f)
  2⤵
  PID:2520
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
    3⤵
    PID:2512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4DY23DRT && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4DY23DRT /grant everyone:(f)
  2⤵
  PID:1740
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4DY23DRT
    3⤵
    PID:2384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\98Y29LGS && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\98Y29LGS /grant everyone:(f)
  2⤵
  PID:2576
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\98Y29LGS
    3⤵
    PID:2260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V /grant everyone:(f)
  2⤵
  PID:2732
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V
    3⤵
    - Modifies file permissions
    PID:1960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CUMHXU73 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CUMHXU73 /grant everyone:(f)
  2⤵
  PID:2712
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CUMHXU73
    3⤵
    PID:2796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K /grant everyone:(f)
  2⤵
  PID:2808
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K
    3⤵
    PID:2984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROLMKJ86 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROLMKJ86 /grant everyone:(f)
  2⤵
  PID:2812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROLMKJ86
    3⤵
    PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T072YXIW && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T072YXIW /grant everyone:(f)
  2⤵
  PID:2876
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T072YXIW
    3⤵
    PID:2736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5 /grant everyone:(f)
  2⤵
  PID:2608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5
    3⤵
    PID:2168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO /grant everyone:(f)
  2⤵
  PID:2784
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO
    3⤵
    - Modifies file permissions
    PID:2776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word /grant everyone:(f)
  2⤵
  PID:2672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word
    3⤵
    PID:2868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low /grant everyone:(f)
  2⤵
  PID:2620
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low
    3⤵
    PID:2428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized /grant everyone:(f)
  2⤵
  PID:2632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized
    3⤵
    PID:2652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache /grant everyone:(f)
  2⤵
  PID:2036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache
    3⤵
    PID:1120
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache /grant everyone:(f)
    3⤵
    PID:2084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Mail /grant everyone:(f)
  2⤵
  PID:2860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail
    3⤵
    PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup /grant everyone:(f)
  2⤵
  PID:2344
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup
    3⤵
    PID:1644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new /grant everyone:(f)
  2⤵
  PID:1916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new
    3⤵
    PID:1636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery /grant everyone:(f)
  2⤵
  PID:2116
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery
    3⤵
    PID:1968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Media && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Media /grant everyone:(f)
  2⤵
  PID:2940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Media
    3⤵
    PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0 && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0 /grant everyone:(f)
  2⤵
  PID:2176
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0
    3⤵
    PID:2916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar /grant everyone:(f)
  2⤵
  PID:2560
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar
    3⤵
    PID:1040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar\Gadgets && icacls C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar\Gadgets /grant everyone:(f)
  2⤵
  PID:2064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar\Gadgets
    3⤵
    PID:1212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Microsoft Help && icacls C:\Users\Admin\AppData\Local\Microsoft Help /grant everyone:(f)
  2⤵
  PID:3048
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Microsoft Help
    3⤵
    PID:280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla && icacls C:\Users\Admin\AppData\Local\Mozilla /grant everyone:(f)
  2⤵
  PID:1628
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla
    3⤵
    PID:2980
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:1624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox /grant everyone:(f)
  2⤵
  PID:2948
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox
    3⤵
    PID:308
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox /grant everyone:(f)
    3⤵
    PID:2140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles /grant everyone:(f)
  2⤵
  PID:1324
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles
    3⤵
    PID:1380
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles /grant everyone:(f)
    3⤵
    PID:1368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.Admin && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.Admin /grant everyone:(f)
  2⤵
  PID:2296
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.Admin
    3⤵
    PID:1716
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.Admin /grant everyone:(f)
    3⤵
    PID:1384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release /grant everyone:(f)
  2⤵
  PID:1356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release
    3⤵
    PID:3052
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:3020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2 && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2 /grant everyone:(f)
  2⤵
  PID:1000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2
    3⤵
    PID:1004
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2 /grant everyone:(f)
    3⤵
    PID:2244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2\doomed && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2\doomed /grant everyone:(f)
  2⤵
  PID:2364
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2\doomed
    3⤵
    PID:2080
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2\doomed /grant everyone:(f)
    3⤵
    PID:2148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2\entries && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2\entries /grant everyone:(f)
  2⤵
  PID:2068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2\entries
    3⤵
    PID:1584
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\cache2\entries /grant everyone:(f)
    3⤵
    PID:1292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\safebrowsing && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\safebrowsing /grant everyone:(f)
  2⤵
  PID:1036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\safebrowsing
    3⤵
    PID:2492
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\safebrowsing /grant everyone:(f)
    3⤵
    PID:1620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings /grant everyone:(f)
  2⤵
  PID:1064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings
    3⤵
    PID:2104
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings /grant everyone:(f)
    3⤵
    PID:1664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main /grant everyone:(f)
  2⤵
  PID:2332
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main
    3⤵
    - Modifies file permissions
    PID:2520
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main /grant everyone:(f)
    3⤵
    PID:1868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs /grant everyone:(f)
  2⤵
  PID:2384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs
    3⤵
    - Possible privilege escalation attempt
    PID:1736
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs /grant everyone:(f)
    3⤵
    PID:1948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs\browser && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs\browser /grant everyone:(f)
  2⤵
  PID:2576
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs\browser
    3⤵
    PID:1960
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs\browser /grant everyone:(f)
    3⤵
    PID:2348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs\browser\newtab && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs\browser\newtab /grant everyone:(f)
  2⤵
  PID:2788
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs\browser\newtab
    3⤵
    - Possible privilege escalation attempt
    PID:2712
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs\browser\newtab /grant everyone:(f)
    3⤵
    PID:2800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\startupCache && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\startupCache /grant everyone:(f)
  2⤵
  PID:2984
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\startupCache
    3⤵
    PID:2820
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\startupCache /grant everyone:(f)
    3⤵
    PID:2636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\thumbnails && icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\thumbnails /grant everyone:(f)
  2⤵
  PID:2812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\thumbnails
    3⤵
    PID:2736
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\thumbnails /grant everyone:(f)
    3⤵
    PID:2764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp && icacls C:\Users\Admin\AppData\Local\Temp /grant everyone:(f)
  2⤵
  PID:1648
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp
    3⤵
    PID:2608
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\2765442843 && icacls C:\Users\Admin\AppData\Local\Temp\2765442843 /grant everyone:(f)
  2⤵
  PID:2776
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\2765442843
    3⤵
    PID:2716
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\2765442843 /grant everyone:(f)
    3⤵
    PID:2724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin && icacls C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin /grant everyone:(f)
  2⤵
  PID:2672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin
    3⤵
    PID:2428
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin /grant everyone:(f)
    3⤵
    PID:2180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\Low && icacls C:\Users\Admin\AppData\Local\Temp\Low /grant everyone:(f)
  2⤵
  PID:2424
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\Low
    3⤵
    PID:352
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\Low /grant everyone:(f)
    3⤵
    PID:2632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219 && icacls C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219 /grant everyone:(f)
  2⤵
  PID:1120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219
    3⤵
    PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219 && icacls C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219 /grant everyone:(f)
  2⤵
  PID:1572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219
    3⤵
    PID:2128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files && icacls C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files /grant everyone:(f)
  2⤵
  PID:596
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files
    3⤵
    PID:2344
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files /grant everyone:(f)
    3⤵
    PID:1144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1324990044 && icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1324990044 /grant everyone:(f)
  2⤵
  PID:1636
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1324990044
    3⤵
    PID:3040
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1324990044 /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:1812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1324990044\CRX_INSTALL && icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1324990044\CRX_INSTALL /grant everyone:(f)
  2⤵
  PID:2116
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1324990044\CRX_INSTALL
    3⤵
    PID:2372
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1324990044\CRX_INSTALL /grant everyone:(f)
    3⤵
    PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1629096196 && icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1629096196 /grant everyone:(f)
  2⤵
  PID:1988
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1629096196
    3⤵
    PID:2932
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1629096196 /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:2188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1629096196\CRX_INSTALL && icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1629096196\CRX_INSTALL /grant everyone:(f)
  2⤵
  PID:1040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1629096196\CRX_INSTALL
    3⤵
    - Modifies file permissions
    PID:2076
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_1629096196\CRX_INSTALL /grant everyone:(f)
    3⤵
    PID:2352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\VBE && icacls C:\Users\Admin\AppData\Local\Temp\VBE /grant everyone:(f)
  2⤵
  PID:2064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\VBE
    3⤵
    PID:280
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\VBE /grant everyone:(f)
    3⤵
    PID:1696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temp\WPDNSE && icacls C:\Users\Admin\AppData\Local\Temp\WPDNSE /grant everyone:(f)
  2⤵
  PID:444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp\WPDNSE
    3⤵
    PID:1624
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\WPDNSE /grant everyone:(f)
    3⤵
    PID:948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Local\Temporary Internet Files && icacls C:\Users\Admin\AppData\Local\Temporary Internet Files /grant everyone:(f)
  2⤵
  PID:1760
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temporary Internet Files
    3⤵
    PID:2140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow && icacls C:\Users\Admin\AppData\LocalLow /grant everyone:(f)
  2⤵
  PID:2996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow
    3⤵
    PID:3044
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow /grant everyone:(f)
    3⤵
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft && icacls C:\Users\Admin\AppData\LocalLow\Microsoft /grant everyone:(f)
  2⤵
  PID:1920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft
    3⤵
    PID:108
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Microsoft /grant everyone:(f)
    3⤵
    PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache && icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache /grant everyone:(f)
  2⤵
  PID:1856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache
    3⤵
    - Modifies file permissions
    PID:1680
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache /grant everyone:(f)
    3⤵
    PID:3016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content && icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content /grant everyone:(f)
  2⤵
  PID:2248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
    3⤵
    PID:1316
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData && icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData /grant everyone:(f)
  2⤵
  PID:2572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
    3⤵
    PID:620
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData /grant everyone:(f)
    3⤵
    PID:884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer && icacls C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer /grant everyone:(f)
  2⤵
  PID:572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer
    3⤵
    PID:2092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services && icacls C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services /grant everyone:(f)
  2⤵
  PID:3036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services
    3⤵
    PID:2444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Mozilla && icacls C:\Users\Admin\AppData\LocalLow\Mozilla /grant everyone:(f)
  2⤵
  PID:2292
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Mozilla
    3⤵
    PID:2072
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Mozilla /grant everyone:(f)
    3⤵
    PID:1724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun && icacls C:\Users\Admin\AppData\LocalLow\Sun /grant everyone:(f)
  2⤵
  PID:2288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun
    3⤵
    PID:2416
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun /grant everyone:(f)
    3⤵
    PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java /grant everyone:(f)
  2⤵
  PID:2520
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java
    3⤵
    PID:2332
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:2392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment /grant everyone:(f)
  2⤵
  PID:1736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment
    3⤵
    PID:2384
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment /grant everyone:(f)
    3⤵
    PID:1344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache /grant everyone:(f)
  2⤵
  PID:1960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache
    3⤵
    PID:2576
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache /grant everyone:(f)
    3⤵
    PID:2448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 /grant everyone:(f)
  2⤵
  PID:2712
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0
    3⤵
    PID:2788
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 /grant everyone:(f)
    3⤵
    PID:2804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 /grant everyone:(f)
  2⤵
  PID:2820
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0
    3⤵
    PID:2984
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 /grant everyone:(f)
    3⤵
    PID:2824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 /grant everyone:(f)
  2⤵
  PID:2736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1
    3⤵
    PID:2812
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 /grant everyone:(f)
    3⤵
    PID:2228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 /grant everyone:(f)
  2⤵
  PID:2832
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10
    3⤵
    PID:2604
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 /grant everyone:(f)
    3⤵
    PID:2656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 /grant everyone:(f)
  2⤵
  PID:2868
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11
    3⤵
    PID:2828
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:2768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 /grant everyone:(f)
  2⤵
  PID:816
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12
    3⤵
    PID:2304
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:1068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 /grant everyone:(f)
  2⤵
  PID:352
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13
    3⤵
    PID:2644
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 /grant everyone:(f)
    3⤵
    PID:2424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 /grant everyone:(f)
  2⤵
  PID:2036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14
    3⤵
    PID:3064
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 /grant everyone:(f)
    3⤵
    PID:1652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 /grant everyone:(f)
  2⤵
  PID:1572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15
    3⤵
    PID:2344
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 /grant everyone:(f)
    3⤵
    PID:1964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 /grant everyone:(f)
  2⤵
  PID:1768
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16
    3⤵
    - Possible privilege escalation attempt
    PID:3040
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 /grant everyone:(f)
    3⤵
    PID:1968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 /grant everyone:(f)
  2⤵
  PID:2896
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17
    3⤵
    - Modifies file permissions
    PID:2372
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 /grant everyone:(f)
  2⤵
  PID:2936
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18
    3⤵
    PID:2932
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 /grant everyone:(f)
    3⤵
    PID:1796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 /grant everyone:(f)
  2⤵
  PID:2300
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19
    3⤵
    PID:2076
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 /grant everyone:(f)
    3⤵
    PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 /grant everyone:(f)
  2⤵
  PID:2196
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2
    3⤵
    PID:280
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 /grant everyone:(f)
    3⤵
    PID:1852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 /grant everyone:(f)
  2⤵
  PID:2064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20
    3⤵
    PID:1624
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 /grant everyone:(f)
    3⤵
    PID:1552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 /grant everyone:(f)
  2⤵
  PID:444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21
    3⤵
    PID:2140
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 /grant everyone:(f)
    3⤵
    PID:1260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 /grant everyone:(f)
  2⤵
  PID:1844
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22
    3⤵
    PID:1720
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 /grant everyone:(f)
    3⤵
    PID:3012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 /grant everyone:(f)
  2⤵
  PID:976
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23
    3⤵
    PID:3008
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 /grant everyone:(f)
    3⤵
    PID:1784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 /grant everyone:(f)
  2⤵
  PID:1776
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24
    3⤵
    PID:3016
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 /grant everyone:(f)
    3⤵
    PID:2296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 /grant everyone:(f)
  2⤵
  PID:780
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25
    3⤵
    PID:696
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 /grant everyone:(f)
    3⤵
    PID:1356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 /grant everyone:(f)
  2⤵
  PID:2312
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26
    3⤵
    PID:884
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 /grant everyone:(f)
    3⤵
    PID:1000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 /grant everyone:(f)
  2⤵
  PID:3032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27
    3⤵
    PID:572
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 /grant everyone:(f)
    3⤵
    PID:1520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 /grant everyone:(f)
  2⤵
  PID:2444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28
    3⤵
    PID:892
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 /grant everyone:(f)
    3⤵
    PID:1036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 /grant everyone:(f)
  2⤵
  PID:1724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29
    3⤵
    PID:2388
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 /grant everyone:(f)
    3⤵
    PID:2416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 /grant everyone:(f)
  2⤵
  PID:1608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3
    3⤵
    PID:1868
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 /grant everyone:(f)
    3⤵
    PID:2332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 /grant everyone:(f)
  2⤵
  PID:2892
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30
    3⤵
    PID:1948
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 /grant everyone:(f)
    3⤵
    PID:2224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 /grant everyone:(f)
  2⤵
  PID:1344
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31
    3⤵
    PID:2208
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 /grant everyone:(f)
    3⤵
    PID:2756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 /grant everyone:(f)
  2⤵
  PID:2448
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32
    3⤵
    PID:2972
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 /grant everyone:(f)
  2⤵
  PID:2804
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33
    3⤵
    PID:2836
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 /grant everyone:(f)
    3⤵
    PID:2720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 /grant everyone:(f)
  2⤵
  PID:2824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34
    3⤵
    PID:2704
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 /grant everyone:(f)
    3⤵
    PID:2888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 /grant everyone:(f)
  2⤵
  PID:2228
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35
    3⤵
    PID:2608
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 /grant everyone:(f)
    3⤵
    PID:2856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 /grant everyone:(f)
  2⤵
  PID:2656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36
    3⤵
    - Modifies file permissions
    PID:2716
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 /grant everyone:(f)
    3⤵
    PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 /grant everyone:(f)
  2⤵
  PID:2768
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37
    3⤵
    PID:2428
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 /grant everyone:(f)
    3⤵
    PID:880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 /grant everyone:(f)
  2⤵
  PID:1068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38
    3⤵
    PID:2612
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 /grant everyone:(f)
    3⤵
    PID:1112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 /grant everyone:(f)
  2⤵
  PID:2424
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39
    3⤵
    PID:1656
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 /grant everyone:(f)
    3⤵
    PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 /grant everyone:(f)
  2⤵
  PID:1652
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4
    3⤵
    - Possible privilege escalation attempt
    PID:2440
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 /grant everyone:(f)
    3⤵
    PID:1660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 /grant everyone:(f)
  2⤵
  PID:1964
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40
    3⤵
    PID:1500
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 /grant everyone:(f)
    3⤵
    PID:1952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 /grant everyone:(f)
  2⤵
  PID:1968
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41
    3⤵
    PID:2004
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 /grant everyone:(f)
    3⤵
    PID:2900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 /grant everyone:(f)
  2⤵
  PID:2940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42
    3⤵
    PID:2640
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 /grant everyone:(f)
    3⤵
    PID:2512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 /grant everyone:(f)
  2⤵
  PID:2188
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43
    3⤵
    - Possible privilege escalation attempt
    PID:2116
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 /grant everyone:(f)
    3⤵
    PID:2400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 /grant everyone:(f)
  2⤵
  PID:2352
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44
    3⤵
    PID:2300
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 /grant everyone:(f)
    3⤵
    PID:1404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 /grant everyone:(f)
  2⤵
  PID:1696
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45
    3⤵
    PID:1040
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 /grant everyone:(f)
    3⤵
    PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 /grant everyone:(f)
  2⤵
  PID:948
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46
    3⤵
    PID:2064
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 /grant everyone:(f)
    3⤵
    PID:1096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 /grant everyone:(f)
  2⤵
  PID:2016
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47
    3⤵
    PID:3000
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 /grant everyone:(f)
    3⤵
    PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 /grant everyone:(f)
  2⤵
  PID:2420
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48
    3⤵
    PID:1380
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 /grant everyone:(f)
    3⤵
    PID:108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 /grant everyone:(f)
  2⤵
  PID:1708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49
    3⤵
    PID:1008
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 /grant everyone:(f)
    3⤵
    PID:904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 /grant everyone:(f)
  2⤵
  PID:1856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5
    3⤵
    PID:3052
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 /grant everyone:(f)
    3⤵
    PID:1316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 /grant everyone:(f)
  2⤵
  PID:2248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50
    3⤵
    PID:1004
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 /grant everyone:(f)
    3⤵
    PID:620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 /grant everyone:(f)
  2⤵
  PID:2572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51
    3⤵
    - Possible privilege escalation attempt
    PID:2080
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 /grant everyone:(f)
  2⤵
  PID:1032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52
    3⤵
    PID:1584
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 /grant everyone:(f)
    3⤵
    PID:3036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 /grant everyone:(f)
  2⤵
  PID:2072
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53
    3⤵
    PID:1292
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 /grant everyone:(f)
    3⤵
    PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 /grant everyone:(f)
  2⤵
  PID:1612
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54
    3⤵
    PID:2492
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 /grant everyone:(f)
    3⤵
    PID:1664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 /grant everyone:(f)
  2⤵
  PID:1592
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55
    3⤵
    PID:2288
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 /grant everyone:(f)
    3⤵
    PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 /grant everyone:(f)
  2⤵
  PID:2384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56
    3⤵
    PID:2520
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 /grant everyone:(f)
    3⤵
    PID:2408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 /grant everyone:(f)
  2⤵
  PID:2576
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57
    3⤵
    - Modifies file permissions
    PID:2544
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 /grant everyone:(f)
    3⤵
    PID:1960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 /grant everyone:(f)
  2⤵
  PID:2788
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58
    3⤵
    PID:2732
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 /grant everyone:(f)
    3⤵
    PID:2712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 /grant everyone:(f)
  2⤵
  PID:2984
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59
    3⤵
    PID:2968
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 /grant everyone:(f)
    3⤵
    PID:2820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 /grant everyone:(f)
  2⤵
  PID:2812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6
    3⤵
    PID:2748
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 /grant everyone:(f)
    3⤵
    PID:2792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 /grant everyone:(f)
  2⤵
  PID:2604
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60
    3⤵
    PID:1632
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 /grant everyone:(f)
    3⤵
    PID:2832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 /grant everyone:(f)
  2⤵
  PID:2828
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61
    3⤵
    PID:2596
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 /grant everyone:(f)
    3⤵
    PID:2724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 /grant everyone:(f)
  2⤵
  PID:2304
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62
    3⤵
    PID:2776
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 /grant everyone:(f)
    3⤵
    PID:816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 /grant everyone:(f)
  2⤵
  PID:2644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63
    3⤵
    PID:1068
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 /grant everyone:(f)
    3⤵
    PID:352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 /grant everyone:(f)
  2⤵
  PID:3064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7
    3⤵
    PID:1936
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 /grant everyone:(f)
    3⤵
    PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 /grant everyone:(f)
  2⤵
  PID:2344
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8
    3⤵
    PID:1976
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 /grant everyone:(f)
    3⤵
    PID:2200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 /grant everyone:(f)
  2⤵
  PID:3040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9
    3⤵
    PID:264
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 /grant everyone:(f)
    3⤵
    PID:1768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host /grant everyone:(f)
  2⤵
  PID:2372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host
    3⤵
    PID:1968
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host /grant everyone:(f)
    3⤵
    PID:1636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin /grant everyone:(f)
  2⤵
  PID:2412
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin
    3⤵
    PID:2912
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security /grant everyone:(f)
  2⤵
  PID:2400
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security
    3⤵
    PID:2360
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security /grant everyone:(f)
    3⤵
    PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64 && icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64 /grant everyone:(f)
  2⤵
  PID:3048
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64
    3⤵
    PID:2152
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64 /grant everyone:(f)
    3⤵
    PID:2908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming && icacls C:\Users\Admin\AppData\Roaming /grant everyone:(f)
  2⤵
  PID:1628
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming
    3⤵
    PID:2164
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming /grant everyone:(f)
    3⤵
    PID:1152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe && icacls C:\Users\Admin\AppData\Roaming\Adobe /grant everyone:(f)
  2⤵
  PID:1320
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe
    3⤵
    - Possible privilege escalation attempt
    PID:2980
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Adobe /grant everyone:(f)
    3⤵
    PID:2052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat && icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat /grant everyone:(f)
  2⤵
  PID:2624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat
    3⤵
    PID:1376
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat /grant everyone:(f)
    3⤵
    PID:1232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0 && icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0 /grant everyone:(f)
  2⤵
  PID:912
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0
    3⤵
    PID:2420
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0 /grant everyone:(f)
    3⤵
    PID:1384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Collab && icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Collab /grant everyone:(f)
  2⤵
  PID:1680
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Collab
    3⤵
    PID:1708
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Collab /grant everyone:(f)
    3⤵
    PID:2192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player && icacls C:\Users\Admin\AppData\Roaming\Adobe\Flash Player /grant everyone:(f)
  2⤵
  PID:2964
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player
    3⤵
    PID:864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache && icacls C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache /grant everyone:(f)
  2⤵
  PID:2252
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache
    3⤵
    PID:1356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache\Z257BEVQ && icacls C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache\Z257BEVQ /grant everyone:(f)
  2⤵
  PID:2276
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache\Z257BEVQ
    3⤵
    PID:2132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\NativeCache && icacls C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\NativeCache /grant everyone:(f)
  2⤵
  PID:1000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\NativeCache
    3⤵
    PID:2236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Identities && icacls C:\Users\Admin\AppData\Roaming\Identities /grant everyone:(f)
  2⤵
  PID:2460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Identities
    3⤵
    PID:1044
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Identities /grant everyone:(f)
    3⤵
    PID:1668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Identities\{977286EF-87A2-462A-9E5B-C27B251936D9} && icacls C:\Users\Admin\AppData\Roaming\Identities\{977286EF-87A2-462A-9E5B-C27B251936D9} /grant everyone:(f)
  2⤵
  PID:1616
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Identities\{977286EF-87A2-462A-9E5B-C27B251936D9}
    3⤵
    PID:2068
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Identities\{977286EF-87A2-462A-9E5B-C27B251936D9} /grant everyone:(f)
    3⤵
    PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia && icacls C:\Users\Admin\AppData\Roaming\Macromedia /grant everyone:(f)
  2⤵
  PID:1788
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia
    3⤵
    PID:2396
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Macromedia /grant everyone:(f)
    3⤵
    PID:2104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player /grant everyone:(f)
  2⤵
  PID:2184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player
    3⤵
    PID:1224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects /grant everyone:(f)
  2⤵
  PID:2528
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects
    3⤵
    PID:2224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\HEWG38XS && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\HEWG38XS /grant everyone:(f)
  2⤵
  PID:2708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\HEWG38XS
    3⤵
    PID:2800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com /grant everyone:(f)
  2⤵
  PID:2756
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com
    3⤵
    PID:2840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support /grant everyone:(f)
  2⤵
  PID:2636
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support
    3⤵
    PID:2336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer /grant everyone:(f)
  2⤵
  PID:2728
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer
    3⤵
    - Possible privilege escalation attempt
    PID:2760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys && icacls C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys /grant everyone:(f)
  2⤵
  PID:2984
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys
    3⤵
    PID:2872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Media Center Programs && icacls C:\Users\Admin\AppData\Roaming\Media Center Programs /grant everyone:(f)
  2⤵
  PID:2816
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Media Center Programs
    3⤵
    PID:2784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft && icacls C:\Users\Admin\AppData\Roaming\Microsoft /grant everyone:(f)
  2⤵
  PID:2676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft
    3⤵
    PID:2604
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft /grant everyone:(f)
    3⤵
    PID:1648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\AddIns && icacls C:\Users\Admin\AppData\Roaming\Microsoft\AddIns /grant everyone:(f)
  2⤵
  PID:2724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\AddIns
    3⤵
    PID:2652
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\AddIns /grant everyone:(f)
    3⤵
    PID:1928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Credentials && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Credentials /grant everyone:(f)
  2⤵
  PID:816
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Credentials
    3⤵
    PID:2084
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Credentials /grant everyone:(f)
    3⤵
    PID:1568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto /grant everyone:(f)
  2⤵
  PID:920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto
    3⤵
    PID:2180
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto /grant everyone:(f)
    3⤵
    PID:2568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA /grant everyone:(f)
  2⤵
  PID:2860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA
    3⤵
    PID:2700
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA /grant everyone:(f)
    3⤵
    PID:1120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312935884-697965778-3955649944-1000 && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312935884-697965778-3955649944-1000 /grant everyone:(f)
  2⤵
  PID:2884
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312935884-697965778-3955649944-1000
    3⤵
    PID:1764
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312935884-697965778-3955649944-1000 /grant everyone:(f)
    3⤵
    PID:1644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Excel && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Excel /grant everyone:(f)
  2⤵
  PID:1684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Excel
    3⤵
    PID:1572
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Excel /grant everyone:(f)
    3⤵
    PID:596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer /grant everyone:(f)
  2⤵
  PID:2924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer
    3⤵
    PID:1916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch /grant everyone:(f)
  2⤵
  PID:3056
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
    3⤵
    PID:2512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned /grant everyone:(f)
  2⤵
  PID:1492
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned
    3⤵
    PID:2300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts /grant everyone:(f)
  2⤵
  PID:2916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts
    3⤵
    PID:2368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar /grant everyone:(f)
  2⤵
  PID:2156
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
    3⤵
    PID:2928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData /grant everyone:(f)
  2⤵
  PID:1672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData
    3⤵
    PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low /grant everyone:(f)
  2⤵
  PID:2536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low
    3⤵
    PID:3000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Office && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Office /grant everyone:(f)
  2⤵
  PID:1096
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Office
    3⤵
    PID:2996
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Office /grant everyone:(f)
    3⤵
    PID:1380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent /grant everyone:(f)
  2⤵
  PID:3044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent
    3⤵
    PID:1164
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent /grant everyone:(f)
    3⤵
    PID:1008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Protect && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Protect /grant everyone:(f)
  2⤵
  PID:108
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Protect
    3⤵
    PID:1600
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Protect /grant everyone:(f)
    3⤵
    PID:3052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-312935884-697965778-3955649944-1000 && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-312935884-697965778-3955649944-1000 /grant everyone:(f)
  2⤵
  PID:904
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-312935884-697965778-3955649944-1000
    3⤵
    PID:1908
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-312935884-697965778-3955649944-1000 /grant everyone:(f)
    3⤵
    PID:1776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates && icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates /grant everyone:(f)
  2⤵
  PID:3020
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates
    3⤵
    PID:1004
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates /grant everyone:(f)
    3⤵
    PID:620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My && icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My /grant everyone:(f)
  2⤵
  PID:2092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My
    3⤵
    PID:2148
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My /grant everyone:(f)
    3⤵
    PID:2236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates && icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates /grant everyone:(f)
  2⤵
  PID:2468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates
    3⤵
    PID:1292
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:1668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs && icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs /grant everyone:(f)
  2⤵
  PID:3032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs
    3⤵
    PID:2492
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs && icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs /grant everyone:(f)
  2⤵
  PID:2444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs
    3⤵
    PID:2288
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs /grant everyone:(f)
    3⤵
    PID:2104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Templates && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Templates /grant everyone:(f)
  2⤵
  PID:1724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Templates
    3⤵
    PID:2380
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Templates /grant everyone:(f)
    3⤵
    PID:1252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows /grant everyone:(f)
  2⤵
  PID:1588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows
    3⤵
    PID:2408
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows /grant everyone:(f)
    3⤵
    PID:2548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies /grant everyone:(f)
  2⤵
  PID:2796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies
    3⤵
    PID:1736
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:2840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low /grant everyone:(f)
  2⤵
  PID:2692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low
    3⤵
    PID:2788
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low /grant everyone:(f)
    3⤵
    PID:2636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException /grant everyone:(f)
  2⤵
  PID:2764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException
    3⤵
    PID:2820
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException /grant everyone:(f)
    3⤵
    PID:2720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low /grant everyone:(f)
  2⤵
  PID:2748
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low
    3⤵
    - Modifies file permissions
    PID:2812
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low /grant everyone:(f)
    3⤵
    PID:2784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache /grant everyone:(f)
  2⤵
  PID:2688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache
    3⤵
    PID:2428
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache /grant everyone:(f)
    3⤵
    PID:1648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache\Low /grant everyone:(f)
  2⤵
  PID:2856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache\Low
    3⤵
    - Possible privilege escalation attempt
    PID:2612
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache\Low /grant everyone:(f)
    3⤵
    PID:1928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache /grant everyone:(f)
  2⤵
  PID:2656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache
    3⤵
    PID:1068
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache /grant everyone:(f)
    3⤵
    PID:1568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low /grant everyone:(f)
  2⤵
  PID:2768
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low
    3⤵
    PID:1936
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low /grant everyone:(f)
    3⤵
    PID:2568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory /grant everyone:(f)
  2⤵
  PID:2644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory
    3⤵
    - Possible privilege escalation attempt
    PID:1976
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory /grant everyone:(f)
    3⤵
    PID:1120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache /grant everyone:(f)
  2⤵
  PID:2424
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache
    3⤵
    PID:264
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:1644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache\Low /grant everyone:(f)
  2⤵
  PID:1652
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache\Low
    3⤵
    - Modifies file permissions
    PID:1968
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache\Low /grant everyone:(f)
    3⤵
    PID:596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries /grant everyone:(f)
  2⤵
  PID:700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries
    3⤵
    PID:2372
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries /grant everyone:(f)
    3⤵
    PID:2924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts /grant everyone:(f)
  2⤵
  PID:2116
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    3⤵
    PID:2220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts /grant everyone:(f)
  2⤵
  PID:2560
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    3⤵
    PID:2360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE /grant everyone:(f)
  2⤵
  PID:1796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE
    3⤵
    PID:840
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE /grant everyone:(f)
    3⤵
    PID:1040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE\Low && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE\Low /grant everyone:(f)
  2⤵
  PID:2908
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE\Low
    3⤵
    PID:648
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE\Low /grant everyone:(f)
    3⤵
    PID:1628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent /grant everyone:(f)
  2⤵
  PID:1672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent
    3⤵
    PID:3000
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent /grant everyone:(f)
    3⤵
    PID:2140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations /grant everyone:(f)
  2⤵
  PID:2144
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
    3⤵
    PID:1380
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations /grant everyone:(f)
    3⤵
    PID:1320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations /grant everyone:(f)
  2⤵
  PID:444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations
    3⤵
    PID:1008
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations /grant everyone:(f)
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo /grant everyone:(f)
  2⤵
  PID:3012
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo
    3⤵
    PID:3052
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo /grant everyone:(f)
    3⤵
    PID:108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu /grant everyone:(f)
  2⤵
  PID:1324
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu
    3⤵
    PID:2296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs /grant everyone:(f)
  2⤵
  PID:696
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    3⤵
    PID:1004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories /grant everyone:(f)
  2⤵
  PID:620
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
    3⤵
    PID:548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility /grant everyone:(f)
  2⤵
  PID:2148
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility
    3⤵
    PID:572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools /grant everyone:(f)
  2⤵
  PID:1000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools
    3⤵
    - Modifies file permissions
    PID:1668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools /grant everyone:(f)
  2⤵
  PID:2468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    3⤵
    PID:2492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance /grant everyone:(f)
  2⤵
  PID:2532
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
    3⤵
    PID:1616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup /grant everyone:(f)
  2⤵
  PID:2288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    3⤵
    PID:2444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates /grant everyone:(f)
  2⤵
  PID:1788
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates
    3⤵
    PID:1252
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates /grant everyone:(f)
    3⤵
    PID:2524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes /grant everyone:(f)
  2⤵
  PID:2208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes
    3⤵
    PID:2548
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes /grant everyone:(f)
    3⤵
    PID:2520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Word && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Word /grant everyone:(f)
  2⤵
  PID:2800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Word
    3⤵
    PID:2840
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Word /grant everyone:(f)
    3⤵
    PID:2972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP /grant everyone:(f)
  2⤵
  PID:2756
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP
    3⤵
    PID:2636
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP /grant everyone:(f)
    3⤵
    PID:2260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla && icacls C:\Users\Admin\AppData\Roaming\Mozilla /grant everyone:(f)
  2⤵
  PID:2452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla
    3⤵
    PID:2720
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla /grant everyone:(f)
    3⤵
    PID:2752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Extensions && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Extensions /grant everyone:(f)
  2⤵
  PID:2872
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Extensions
    3⤵
    - Modifies file permissions
    PID:2784
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Extensions /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:2376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox /grant everyone:(f)
  2⤵
  PID:2816
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox
    3⤵
    - Modifies file permissions
    PID:1648
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox /grant everyone:(f)
    3⤵
    PID:2888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports /grant everyone:(f)
  2⤵
  PID:2676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports
    3⤵
    PID:1928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events /grant everyone:(f)
  2⤵
  PID:2856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events
    3⤵
    PID:1068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings /grant everyone:(f)
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1568
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings
    3⤵
    PID:816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles /grant everyone:(f)
  2⤵
  PID:1936
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles
    3⤵
    PID:2768
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles /grant everyone:(f)
    3⤵
    PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.Admin && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.Admin /grant everyone:(f)
  2⤵
  PID:1976
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.Admin
    3⤵
    PID:2644
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.Admin /grant everyone:(f)
    3⤵
    PID:2440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release /grant everyone:(f)
  2⤵
  PID:264
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release
    3⤵
    PID:2424
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release /grant everyone:(f)
    3⤵
    PID:1500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\bookmarkbackups && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\bookmarkbackups /grant everyone:(f)
  2⤵
  PID:1968
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\bookmarkbackups
    3⤵
    PID:3028
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\bookmarkbackups /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    PID:1684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\browser-extension-data && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\browser-extension-data /grant everyone:(f)
  2⤵
  PID:2920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\browser-extension-data
    3⤵
    - Possible privilege escalation attempt
    PID:2932
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\browser-extension-data /grant everyone:(f)
    3⤵
    PID:1560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\browser-extension-data\[email protected] && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\browser-extension-data\[email protected] /grant everyone:(f)
  2⤵
  PID:3056
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\browser-extension-data\[email protected]
    3⤵
    - Modifies file permissions
    PID:1064
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\browser-extension-data\[email protected] /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:2360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\crashes && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\crashes /grant everyone:(f)
  2⤵
  PID:1212
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\crashes
    3⤵
    PID:1224
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\crashes /grant everyone:(f)
    3⤵
    PID:1404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\crashes\events && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\crashes\events /grant everyone:(f)
  2⤵
  PID:1796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\crashes\events
    3⤵
    - Possible privilege escalation attempt
    PID:648
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\crashes\events /grant everyone:(f)
    3⤵
    PID:2196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting /grant everyone:(f)
  2⤵
  PID:2908
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting
    3⤵
    PID:3000
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting /grant everyone:(f)
    3⤵
    PID:1552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean /grant everyone:(f)
  2⤵
  PID:1672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean
    3⤵
    PID:1380
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean /grant everyone:(f)
    3⤵
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\db && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\db /grant everyone:(f)
  2⤵
  PID:2144
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\db
    3⤵
    PID:2044
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\db /grant everyone:(f)
    3⤵
    PID:1008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\events && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\events /grant everyone:(f)
  2⤵
  PID:1384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\events
    3⤵
    PID:1600
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\events /grant everyone:(f)
    3⤵
    PID:3052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings /grant everyone:(f)
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings
    3⤵
    PID:1316
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings /grant everyone:(f)
    3⤵
    PID:2296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\tmp && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\tmp /grant everyone:(f)
  2⤵
  PID:1776
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\tmp
    3⤵
    PID:2248
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\tmp /grant everyone:(f)
    3⤵
    PID:696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\extension-store && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\extension-store /grant everyone:(f)
  2⤵
  PID:1448
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\extension-store
    3⤵
    - Possible privilege escalation attempt
    PID:1752
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\extension-store /grant everyone:(f)
    3⤵
    - Modifies file permissions
    PID:1584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\minidumps && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\minidumps /grant everyone:(f)
  2⤵
  PID:2276
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\minidumps
    3⤵
    PID:1292
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\minidumps /grant everyone:(f)
    3⤵
    PID:1668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\security_state && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\security_state /grant everyone:(f)
  2⤵
  PID:3036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\security_state
    3⤵
    PID:2280
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\security_state /grant everyone:(f)
    3⤵
    PID:1036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\sessionstore-backups && icacls C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\sessionstore-backups /grant everyone:(f)
  2⤵
  PID:2416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\sessionstore-backups
    3⤵
    PID:2532