39c8ccd2419b202937765877092462839cbfd3d7193faaac9d463c0d8924e5ad

Analysis

max time kernel
150s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.vbs
Size 998B
Sample241001-vgfe4azgmk
SHA256 39c8ccd2419b202937765877092462839cbfd3d7193faaac9d463c0d8924e5ad
MD5 7a8d1f9e5e485683c25f1a8170538d8f
SHA1 5623bb9d6d7f11f67d817e07c5ac75d3e14d03e9
SHA512 5b96db20eeec22dbe6d5073fd79b6111f5635a45e2ff97776777156e41c99730f8efa11f6241bd1175658309343b354b5f66ab6a9f9d48df3ef3fc8cf3cb4a14
MD5 SHA1 SHA512

Score

9^/10

discovery exploit ransomware

Malware Config

Signatures

Renames multiple (6763) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
1160	Process not Found
2384	Process not Found
400	Process not Found
3740	takeown.exe
4796	takeown.exe
2648	Process not Found
2352	Process not Found
4032	Process not Found
4496	Process not Found
380	takeown.exe
4340	takeown.exe
4308	takeown.exe
3424	Process not Found
2296	Process not Found
2252	Process not Found
4776	Process not Found
3860	takeown.exe
820	takeown.exe
2956	takeown.exe
4036	takeown.exe
2332	takeown.exe
4380	Process not Found
1992	Process not Found
4956	Process not Found
820	Process not Found
4860	Process not Found
2528	Process not Found
5112	Process not Found
2828	takeown.exe
2216	takeown.exe
2380	takeown.exe
1540	Process not Found
4364	Process not Found
316	Process not Found
3952	Process not Found
3248	takeown.exe
4736	takeown.exe
4476	takeown.exe
464	takeown.exe
1896	Process not Found
948	takeown.exe
3144	Process not Found
3248	Process not Found
380	Process not Found
1196	Process not Found
4092	takeown.exe
4224	takeown.exe
4380	takeown.exe
4280	Process not Found
5080	Process not Found
4460	Process not Found
3508	Process not Found
3672	Process not Found
668	Process not Found
2812	Process not Found
2856	takeown.exe
1908	takeown.exe
1156	Process not Found
4820	Process not Found
5024	Process not Found
1896	takeown.exe
4968	Process not Found
1624	Process not Found
3612	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	WScript.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1724	Process not Found
5028	Process not Found
2356	Process not Found
4448	Process not Found
3540	Process not Found
3708	Process not Found
3900	Process not Found
4764	takeown.exe
2168	Process not Found
1092	Process not Found
3176	Process not Found
2256	Process not Found
4308	Process not Found
2964	Process not Found
5016	Process not Found
1632	Process not Found
820	Process not Found
1908	takeown.exe
2704	Process not Found
3296	Process not Found
1472	takeown.exe
5040	takeown.exe
4852	Process not Found
1160	Process not Found
3288	Process not Found
3108	Process not Found
4176	Process not Found
3792	takeown.exe
1152	Process not Found
468	Process not Found
1944	Process not Found
4500	Process not Found
60	Process not Found
5008	Process not Found
4220	takeown.exe
2172	takeown.exe
1328	takeown.exe
1440	takeown.exe
4640	Process not Found
3184	Process not Found
536	Process not Found
1440	Process not Found
3028	Process not Found
4588	Process not Found
4952	takeown.exe
3184	takeown.exe
2192	takeown.exe
1924	Process not Found
3000	Process not Found
3140	Process not Found
840	Process not Found
2512	Process not Found
5100	Process not Found
3288	Process not Found
2016	Process not Found
4652	Process not Found
3236	Process not Found
4380	Process not Found
5000	takeown.exe
2808	takeown.exe
3960	Process not Found
4568	takeown.exe
3264	takeown.exe
5064	Process not Found

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini	WScript.exe
File created	C:\Program Files\desktop.ini	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	WScript.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DenyResize.tmp	WScript.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll	WScript.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll	WScript.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll	WScript.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrome.7z	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\PICTIM32.FLT	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libchain_plugin.dll	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll	WScript.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-black_scale-125.png	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\156.png	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Images\fre_background.jpg	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\no_camera_dialog_image01.jpg	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Diagnostics.Tracing.dll	WScript.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui	WScript.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-white_scale-125.png	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bg-BG\View3d\3DViewerProductDescription-universal.xml	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-200.png	WScript.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	WScript.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb	WScript.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fil-PH\View3d\3DViewerProductDescription-universal.xml	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-200.png	WScript.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoBeta.png	WScript.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileMediumSquare.scale-200.png	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-125.png	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\am-ET\View3d\3DViewerProductDescription-universal.xml	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteLargeTile.scale-100.png	WScript.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll	WScript.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll	WScript.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	WScript.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200_contrast-white.png	WScript.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200.png	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Microsoft.People.Relevance.QueryClient.dll	WScript.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL082.XML	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\libaudiobargraph_v_plugin.dll	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MixedRealityPortalMedTile.scale-100.png	WScript.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	WScript.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML	WScript.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	WScript.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\PREVIEW.GIF	WScript.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 8 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1628	Process not Found
3188	Process not Found
1372	Process not Found
3292	Process not Found
4288	Process not Found
3320	Process not Found
2952	Process not Found
4392	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1396	WScript.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1396	WScript.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4772	1396	WScript.exe	82
PID 1396 wrote to memory of 4772	1396	WScript.exe	82
PID 4772 wrote to memory of 4780	4772	cmd.exe	84
PID 4772 wrote to memory of 4780	4772	cmd.exe	84
PID 4772 wrote to memory of 3708	4772	cmd.exe	85
PID 4772 wrote to memory of 3708	4772	cmd.exe	85
PID 1396 wrote to memory of 5100	1396	WScript.exe	86
PID 1396 wrote to memory of 5100	1396	WScript.exe	86
PID 5100 wrote to memory of 3964	5100	cmd.exe	88
PID 5100 wrote to memory of 3964	5100	cmd.exe	88
PID 5100 wrote to memory of 3780	5100	cmd.exe	89
PID 5100 wrote to memory of 3780	5100	cmd.exe	89
PID 1396 wrote to memory of 4744	1396	WScript.exe	90
PID 1396 wrote to memory of 4744	1396	WScript.exe	90
PID 4744 wrote to memory of 4572	4744	cmd.exe	92
PID 4744 wrote to memory of 4572	4744	cmd.exe	92
PID 4744 wrote to memory of 644	4744	cmd.exe	93
PID 4744 wrote to memory of 644	4744	cmd.exe	93
PID 1396 wrote to memory of 3556	1396	WScript.exe	94
PID 1396 wrote to memory of 3556	1396	WScript.exe	94
PID 3556 wrote to memory of 2964	3556	cmd.exe	96
PID 3556 wrote to memory of 2964	3556	cmd.exe	96
PID 1396 wrote to memory of 3316	1396	WScript.exe	97
PID 1396 wrote to memory of 3316	1396	WScript.exe	97
PID 3316 wrote to memory of 4576	3316	cmd.exe	99
PID 3316 wrote to memory of 4576	3316	cmd.exe	99
PID 3316 wrote to memory of 4516	3316	cmd.exe	100
PID 3316 wrote to memory of 4516	3316	cmd.exe	100
PID 1396 wrote to memory of 2816	1396	WScript.exe	101
PID 1396 wrote to memory of 2816	1396	WScript.exe	101
PID 2816 wrote to memory of 5000	2816	cmd.exe	103
PID 2816 wrote to memory of 5000	2816	cmd.exe	103
PID 1396 wrote to memory of 1064	1396	WScript.exe	104
PID 1396 wrote to memory of 1064	1396	WScript.exe	104
PID 1064 wrote to memory of 1264	1064	cmd.exe	106
PID 1064 wrote to memory of 1264	1064	cmd.exe	106
PID 1396 wrote to memory of 3672	1396	WScript.exe	107
PID 1396 wrote to memory of 3672	1396	WScript.exe	107
PID 3672 wrote to memory of 2312	3672	cmd.exe	109
PID 3672 wrote to memory of 2312	3672	cmd.exe	109
PID 1396 wrote to memory of 1032	1396	WScript.exe	110
PID 1396 wrote to memory of 1032	1396	WScript.exe	110
PID 1032 wrote to memory of 4792	1032	cmd.exe	112
PID 1032 wrote to memory of 4792	1032	cmd.exe	112
PID 1396 wrote to memory of 1328	1396	WScript.exe	113
PID 1396 wrote to memory of 1328	1396	WScript.exe	113
PID 1328 wrote to memory of 2008	1328	cmd.exe	115
PID 1328 wrote to memory of 2008	1328	cmd.exe	115
PID 1396 wrote to memory of 452	1396	WScript.exe	116
PID 1396 wrote to memory of 452	1396	WScript.exe	116
PID 452 wrote to memory of 2656	452	cmd.exe	118
PID 452 wrote to memory of 2656	452	cmd.exe	118
PID 1396 wrote to memory of 3796	1396	WScript.exe	119
PID 1396 wrote to memory of 3796	1396	WScript.exe	119
PID 3796 wrote to memory of 3004	3796	cmd.exe	121
PID 3796 wrote to memory of 3004	3796	cmd.exe	121
PID 1396 wrote to memory of 1064	1396	WScript.exe	122
PID 1396 wrote to memory of 1064	1396	WScript.exe	122
PID 1064 wrote to memory of 1944	1064	cmd.exe	124
PID 1064 wrote to memory of 1944	1064	cmd.exe	124
PID 1396 wrote to memory of 408	1396	WScript.exe	125
PID 1396 wrote to memory of 408	1396	WScript.exe	125
PID 408 wrote to memory of 3284	408	cmd.exe	127
PID 408 wrote to memory of 3284	408	cmd.exe	127

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file.vbs"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\ && icacls C:\ /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\
    3⤵
    PID:4780
- - C:\Windows\system32\icacls.exe
    icacls C:\ /grant everyone:(f)
    3⤵
    PID:3708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\$Recycle.Bin && icacls C:\$Recycle.Bin /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\system32\takeown.exe
    takeown /f C:\$Recycle.Bin
    3⤵
    PID:3964
- - C:\Windows\system32\icacls.exe
    icacls C:\$Recycle.Bin /grant everyone:(f)
    3⤵
    PID:3780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000 && icacls C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000 /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000
    3⤵
    PID:4572
- - C:\Windows\system32\icacls.exe
    icacls C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000 /grant everyone:(f)
    3⤵
    PID:644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Documents and Settings && icacls C:\Documents and Settings /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Documents and Settings
    3⤵
    PID:2964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\PerfLogs && icacls C:\PerfLogs /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\PerfLogs
    3⤵
    PID:4576
- - C:\Windows\system32\icacls.exe
    icacls C:\PerfLogs /grant everyone:(f)
    3⤵
    PID:4516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files && icacls C:\Program Files /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files
    3⤵
    - Modifies file permissions
    PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\7-Zip && icacls C:\Program Files\7-Zip /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\7-Zip
    3⤵
    PID:1264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\7-Zip\Lang && icacls C:\Program Files\7-Zip\Lang /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\7-Zip\Lang
    3⤵
    PID:2312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files && icacls C:\Program Files\Common Files /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files
    3⤵
    PID:4792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\DESIGNER && icacls C:\Program Files\Common Files\DESIGNER /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\DESIGNER
    3⤵
    PID:2008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared && icacls C:\Program Files\Common Files\microsoft shared /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared
    3⤵
    PID:2656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ClickToRun && icacls C:\Program Files\Common Files\microsoft shared\ClickToRun /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ClickToRun
    3⤵
    PID:3004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink && icacls C:\Program Files\Common Files\microsoft shared\ink /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink
    3⤵
    PID:1944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\ar-SA && icacls C:\Program Files\Common Files\microsoft shared\ink\ar-SA /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\ar-SA
    3⤵
    PID:3284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\bg-BG && icacls C:\Program Files\Common Files\microsoft shared\ink\bg-BG /grant everyone:(f)
  2⤵
  PID:3488
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\bg-BG
    3⤵
    PID:1732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\cs-CZ && icacls C:\Program Files\Common Files\microsoft shared\ink\cs-CZ /grant everyone:(f)
  2⤵
  PID:216
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\cs-CZ
    3⤵
    PID:2812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\da-DK && icacls C:\Program Files\Common Files\microsoft shared\ink\da-DK /grant everyone:(f)
  2⤵
  PID:692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\da-DK
    3⤵
    PID:3692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\de-DE && icacls C:\Program Files\Common Files\microsoft shared\ink\de-DE /grant everyone:(f)
  2⤵
  PID:3032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\de-DE
    3⤵
    PID:1724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\el-GR && icacls C:\Program Files\Common Files\microsoft shared\ink\el-GR /grant everyone:(f)
  2⤵
  PID:1540
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\el-GR
    3⤵
    PID:3744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\en-GB && icacls C:\Program Files\Common Files\microsoft shared\ink\en-GB /grant everyone:(f)
  2⤵
  PID:3408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\en-GB
    3⤵
    PID:1292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\en-US && icacls C:\Program Files\Common Files\microsoft shared\ink\en-US /grant everyone:(f)
  2⤵
  PID:3288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\en-US
    3⤵
    PID:3596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\es-ES && icacls C:\Program Files\Common Files\microsoft shared\ink\es-ES /grant everyone:(f)
  2⤵
  PID:756
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\es-ES
    3⤵
    PID:4720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\es-MX && icacls C:\Program Files\Common Files\microsoft shared\ink\es-MX /grant everyone:(f)
  2⤵
  PID:2060
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\es-MX
    3⤵
    PID:1584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\et-EE && icacls C:\Program Files\Common Files\microsoft shared\ink\et-EE /grant everyone:(f)
  2⤵
  PID:3272
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\et-EE
    3⤵
    PID:2976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fi-FI && icacls C:\Program Files\Common Files\microsoft shared\ink\fi-FI /grant everyone:(f)
  2⤵
  PID:924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fi-FI
    3⤵
    PID:4316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fr-CA && icacls C:\Program Files\Common Files\microsoft shared\ink\fr-CA /grant everyone:(f)
  2⤵
  PID:1344
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fr-CA
    3⤵
    PID:380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fr-FR && icacls C:\Program Files\Common Files\microsoft shared\ink\fr-FR /grant everyone:(f)
  2⤵
  PID:728
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fr-FR
    3⤵
    PID:1748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions /grant everyone:(f)
  2⤵
  PID:1444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions
    3⤵
    PID:4776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad /grant everyone:(f)
  2⤵
  PID:3460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad
    3⤵
    PID:452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert /grant everyone:(f)
  2⤵
  PID:2656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert
    3⤵
    PID:3964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad /grant everyone:(f)
  2⤵
  PID:2996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad
    3⤵
    PID:384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main /grant everyone:(f)
  2⤵
  PID:4908
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main
    3⤵
    PID:4220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui /grant everyone:(f)
  2⤵
  PID:4380
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui
    3⤵
    PID:3604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu /grant everyone:(f)
  2⤵
  PID:544
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu
    3⤵
    PID:4800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav /grant everyone:(f)
  2⤵
  PID:5064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav
    3⤵
    PID:3208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad /grant everyone:(f)
  2⤵
  PID:2216
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad
    3⤵
    PID:1140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred /grant everyone:(f)
  2⤵
  PID:2172
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred
    3⤵
    PID:2128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols /grant everyone:(f)
  2⤵
  PID:2900
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols
    3⤵
    PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\he-IL && icacls C:\Program Files\Common Files\microsoft shared\ink\he-IL /grant everyone:(f)
  2⤵
  PID:3016
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\he-IL
    3⤵
    PID:4580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\hr-HR && icacls C:\Program Files\Common Files\microsoft shared\ink\hr-HR /grant everyone:(f)
  2⤵
  PID:5008
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\hr-HR
    3⤵
    PID:668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\hu-HU && icacls C:\Program Files\Common Files\microsoft shared\ink\hu-HU /grant everyone:(f)
  2⤵
  PID:5044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\hu-HU
    3⤵
    PID:4224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization && icacls C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization /grant everyone:(f)
  2⤵
  PID:656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization
    3⤵
    PID:4436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\it-IT && icacls C:\Program Files\Common Files\microsoft shared\ink\it-IT /grant everyone:(f)
  2⤵
  PID:1264
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\it-IT
    3⤵
    PID:3320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\ja-JP && icacls C:\Program Files\Common Files\microsoft shared\ink\ja-JP /grant everyone:(f)
  2⤵
  PID:4564
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\ja-JP
    3⤵
    PID:884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\ko-KR && icacls C:\Program Files\Common Files\microsoft shared\ink\ko-KR /grant everyone:(f)
  2⤵
  PID:2812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\ko-KR
    3⤵
    PID:1028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\LanguageModel && icacls C:\Program Files\Common Files\microsoft shared\ink\LanguageModel /grant everyone:(f)
  2⤵
  PID:4708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\LanguageModel
    3⤵
    PID:3032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\lt-LT && icacls C:\Program Files\Common Files\microsoft shared\ink\lt-LT /grant everyone:(f)
  2⤵
  PID:1764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\lt-LT
    3⤵
    PID:1540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\lv-LV && icacls C:\Program Files\Common Files\microsoft shared\ink\lv-LV /grant everyone:(f)
  2⤵
  PID:3744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\lv-LV
    3⤵
    PID:1400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\nb-NO && icacls C:\Program Files\Common Files\microsoft shared\ink\nb-NO /grant everyone:(f)
  2⤵
  PID:2416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\nb-NO
    3⤵
    PID:3760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\nl-NL && icacls C:\Program Files\Common Files\microsoft shared\ink\nl-NL /grant everyone:(f)
  2⤵
  PID:4588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\nl-NL
    3⤵
    PID:3196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\pl-PL && icacls C:\Program Files\Common Files\microsoft shared\ink\pl-PL /grant everyone:(f)
  2⤵
  PID:1676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\pl-PL
    3⤵
    PID:3248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\pt-BR && icacls C:\Program Files\Common Files\microsoft shared\ink\pt-BR /grant everyone:(f)
  2⤵
  PID:3108
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\pt-BR
    3⤵
    PID:4076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\pt-PT && icacls C:\Program Files\Common Files\microsoft shared\ink\pt-PT /grant everyone:(f)
  2⤵
  PID:1520
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\pt-PT
    3⤵
    PID:4464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\ro-RO && icacls C:\Program Files\Common Files\microsoft shared\ink\ro-RO /grant everyone:(f)
  2⤵
  PID:4956
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\ro-RO
    3⤵
    PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\ru-RU && icacls C:\Program Files\Common Files\microsoft shared\ink\ru-RU /grant everyone:(f)
  2⤵
  PID:4792
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\ru-RU
    3⤵
    PID:2288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\sk-SK && icacls C:\Program Files\Common Files\microsoft shared\ink\sk-SK /grant everyone:(f)
  2⤵
  PID:2320
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\sk-SK
    3⤵
    PID:3788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\sl-SI && icacls C:\Program Files\Common Files\microsoft shared\ink\sl-SI /grant everyone:(f)
  2⤵
  PID:2008
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\sl-SI
    3⤵
    - Modifies file permissions
    PID:3792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS && icacls C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS /grant everyone:(f)
  2⤵
  PID:3448
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS
    3⤵
    PID:3964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\sv-SE && icacls C:\Program Files\Common Files\microsoft shared\ink\sv-SE /grant everyone:(f)
  2⤵
  PID:4028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\sv-SE
    3⤵
    PID:4716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\th-TH && icacls C:\Program Files\Common Files\microsoft shared\ink\th-TH /grant everyone:(f)
  2⤵
  PID:1152
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\th-TH
    3⤵
    PID:3996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\tr-TR && icacls C:\Program Files\Common Files\microsoft shared\ink\tr-TR /grant everyone:(f)
  2⤵
  PID:3140
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\tr-TR
    3⤵
    PID:2284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\uk-UA && icacls C:\Program Files\Common Files\microsoft shared\ink\uk-UA /grant everyone:(f)
  2⤵
  PID:3384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\uk-UA
    3⤵
    PID:4456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\zh-CN && icacls C:\Program Files\Common Files\microsoft shared\ink\zh-CN /grant everyone:(f)
  2⤵
  PID:5104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\zh-CN
    3⤵
    PID:1380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\zh-TW && icacls C:\Program Files\Common Files\microsoft shared\ink\zh-TW /grant everyone:(f)
  2⤵
  PID:3220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\zh-TW
    3⤵
    PID:3104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo && icacls C:\Program Files\Common Files\microsoft shared\MSInfo /grant everyone:(f)
  2⤵
  PID:3028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo
    3⤵
    PID:4432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE /grant everyone:(f)
  2⤵
  PID:1864
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE
    3⤵
    PID:232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\en-US && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\en-US /grant everyone:(f)
  2⤵
  PID:5040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\en-US
    3⤵
    PID:220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES /grant everyone:(f)
  2⤵
  PID:2356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES
    3⤵
    PID:3456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR /grant everyone:(f)
  2⤵
  PID:8
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR
    3⤵
    PID:4500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT /grant everyone:(f)
  2⤵
  PID:4224
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT
    3⤵
    PID:1596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP /grant everyone:(f)
  2⤵
  PID:1392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP
    3⤵
    PID:2548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA /grant everyone:(f)
  2⤵
  PID:3772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA
    3⤵
    PID:884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\OFFICE16 && icacls C:\Program Files\Common Files\microsoft shared\OFFICE16 /grant everyone:(f)
  2⤵
  PID:692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\OFFICE16
    3⤵
    PID:3692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller && icacls C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller /grant everyone:(f)
  2⤵
  PID:2608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller
    3⤵
    PID:4360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform && icacls C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform /grant everyone:(f)
  2⤵
  PID:1764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform
    3⤵
    - Possible privilege escalation attempt
    PID:948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\Source Engine && icacls C:\Program Files\Common Files\microsoft shared\Source Engine /grant everyone:(f)
  2⤵
  PID:4468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\Source Engine
    3⤵
    PID:1424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\Stationery && icacls C:\Program Files\Common Files\microsoft shared\Stationery /grant everyone:(f)
  2⤵
  PID:3596
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\Stationery
    3⤵
    PID:1268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\TextConv && icacls C:\Program Files\Common Files\microsoft shared\TextConv /grant everyone:(f)
  2⤵
  PID:4248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\TextConv
    3⤵
    PID:2712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\TextConv\en-US && icacls C:\Program Files\Common Files\microsoft shared\TextConv\en-US /grant everyone:(f)
  2⤵
  PID:5012
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\TextConv\en-US
    3⤵
    PID:3272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\Triedit && icacls C:\Program Files\Common Files\microsoft shared\Triedit /grant everyone:(f)
  2⤵
  PID:3108
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\Triedit
    3⤵
    PID:4324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\Triedit\en-US && icacls C:\Program Files\Common Files\microsoft shared\Triedit\en-US /grant everyone:(f)
  2⤵
  PID:4336
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\Triedit\en-US
    3⤵
    PID:380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\VC && icacls C:\Program Files\Common Files\microsoft shared\VC /grant everyone:(f)
  2⤵
  PID:1472
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\VC
    3⤵
    PID:4192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\VGX && icacls C:\Program Files\Common Files\microsoft shared\VGX /grant everyone:(f)
  2⤵
  PID:4208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\VGX
    3⤵
    PID:564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\VSTO && icacls C:\Program Files\Common Files\microsoft shared\VSTO /grant everyone:(f)
  2⤵
  PID:1188
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\VSTO
    3⤵
    PID:1880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\VSTO\10.0 && icacls C:\Program Files\Common Files\microsoft shared\VSTO\10.0 /grant everyone:(f)
  2⤵
  PID:4804
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\VSTO\10.0
    3⤵
    PID:3508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033 && icacls C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033 /grant everyone:(f)
  2⤵
  PID:3424
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033
    3⤵
    - Modifies file permissions
    PID:4220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\Services && icacls C:\Program Files\Common Files\Services /grant everyone:(f)
  2⤵
  PID:2864
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\Services
    3⤵
    PID:4448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System && icacls C:\Program Files\Common Files\System /grant everyone:(f)
  2⤵
  PID:1420
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System
    3⤵
    PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado && icacls C:\Program Files\Common Files\System\ado /grant everyone:(f)
  2⤵
  PID:2648
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado
    3⤵
    PID:3236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\de-DE && icacls C:\Program Files\Common Files\System\ado\de-DE /grant everyone:(f)
  2⤵
  PID:672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\de-DE
    3⤵
    PID:3184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\en-US && icacls C:\Program Files\Common Files\System\ado\en-US /grant everyone:(f)
  2⤵
  PID:2216
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\en-US
    3⤵
    PID:184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\es-ES && icacls C:\Program Files\Common Files\System\ado\es-ES /grant everyone:(f)
  2⤵
  PID:4828
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\es-ES
    3⤵
    PID:1864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\fr-FR && icacls C:\Program Files\Common Files\System\ado\fr-FR /grant everyone:(f)
  2⤵
  PID:3308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\fr-FR
    3⤵
    PID:3684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\it-IT && icacls C:\Program Files\Common Files\System\ado\it-IT /grant everyone:(f)
  2⤵
  PID:2644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\it-IT
    3⤵
    PID:3088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\ja-JP && icacls C:\Program Files\Common Files\System\ado\ja-JP /grant everyone:(f)
  2⤵
  PID:1656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\ja-JP
    3⤵
    PID:4952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\de-DE && icacls C:\Program Files\Common Files\System\de-DE /grant everyone:(f)
  2⤵
  PID:1476
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\de-DE
    3⤵
    PID:408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\en-US && icacls C:\Program Files\Common Files\System\en-US /grant everyone:(f)
  2⤵
  PID:2828
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\en-US
    3⤵
    PID:1392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\es-ES && icacls C:\Program Files\Common Files\System\es-ES /grant everyone:(f)
  2⤵
  PID:3592
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\es-ES
    3⤵
    PID:4320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\fr-FR && icacls C:\Program Files\Common Files\System\fr-FR /grant everyone:(f)
  2⤵
  PID:2792
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\fr-FR
    3⤵
    PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\it-IT && icacls C:\Program Files\Common Files\System\it-IT /grant everyone:(f)
  2⤵
  PID:2812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\it-IT
    3⤵
    PID:4708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ja-JP && icacls C:\Program Files\Common Files\System\ja-JP /grant everyone:(f)
  2⤵
  PID:2808
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ja-JP
    3⤵
    PID:1604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc && icacls C:\Program Files\Common Files\System\msadc /grant everyone:(f)
  2⤵
  PID:1764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc
    3⤵
    PID:3288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\de-DE && icacls C:\Program Files\Common Files\System\msadc\de-DE /grant everyone:(f)
  2⤵
  PID:4468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\de-DE
    3⤵
    PID:1896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\en-US && icacls C:\Program Files\Common Files\System\msadc\en-US /grant everyone:(f)
  2⤵
  PID:4364
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\en-US
    3⤵
    PID:1132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\es-ES && icacls C:\Program Files\Common Files\System\msadc\es-ES /grant everyone:(f)
  2⤵
  PID:2112
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\es-ES
    3⤵
    PID:3572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\fr-FR && icacls C:\Program Files\Common Files\System\msadc\fr-FR /grant everyone:(f)
  2⤵
  PID:1248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\fr-FR
    3⤵
    PID:4488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\it-IT && icacls C:\Program Files\Common Files\System\msadc\it-IT /grant everyone:(f)
  2⤵
  PID:924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\it-IT
    3⤵
    PID:4660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\ja-JP && icacls C:\Program Files\Common Files\System\msadc\ja-JP /grant everyone:(f)
  2⤵
  PID:380
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\ja-JP
    3⤵
    PID:4740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB && icacls C:\Program Files\Common Files\System\Ole DB /grant everyone:(f)
  2⤵
  PID:4772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB
    3⤵
    PID:4792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\de-DE && icacls C:\Program Files\Common Files\System\Ole DB\de-DE /grant everyone:(f)
  2⤵
  PID:1456
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\de-DE
    3⤵
    PID:2856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\en-US && icacls C:\Program Files\Common Files\System\Ole DB\en-US /grant everyone:(f)
  2⤵
  PID:3536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\en-US
    3⤵
    - Modifies file permissions
    PID:4568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\es-ES && icacls C:\Program Files\Common Files\System\Ole DB\es-ES /grant everyone:(f)
  2⤵
  PID:2680
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\es-ES
    3⤵
    PID:2656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\fr-FR && icacls C:\Program Files\Common Files\System\Ole DB\fr-FR /grant everyone:(f)
  2⤵
  PID:4804
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\fr-FR
    3⤵
    PID:2996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\it-IT && icacls C:\Program Files\Common Files\System\Ole DB\it-IT /grant everyone:(f)
  2⤵
  PID:3736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\it-IT
    3⤵
    PID:60
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\ja-JP && icacls C:\Program Files\Common Files\System\Ole DB\ja-JP /grant everyone:(f)
  2⤵
  PID:4960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\ja-JP
    3⤵
    PID:3140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\uk-UA && icacls C:\Program Files\Common Files\System\uk-UA /grant everyone:(f)
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\uk-UA
    3⤵
    PID:1440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Crashpad && icacls C:\Program Files\Crashpad /grant everyone:(f)
  2⤵
  PID:4868
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Crashpad
    3⤵
    PID:3236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Crashpad\attachments && icacls C:\Program Files\Crashpad\attachments /grant everyone:(f)
  2⤵
  PID:3260
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Crashpad\attachments
    3⤵
    PID:4308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Crashpad\reports && icacls C:\Program Files\Crashpad\reports /grant everyone:(f)
  2⤵
  PID:3012
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Crashpad\reports
    3⤵
    PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet && icacls C:\Program Files\dotnet /grant everyone:(f)
  2⤵
  PID:3008
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet
    3⤵
    PID:4484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\host && icacls C:\Program Files\dotnet\host /grant everyone:(f)
  2⤵
  PID:1096
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\host
    3⤵
    PID:5008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\host\fxr && icacls C:\Program Files\dotnet\host\fxr /grant everyone:(f)
  2⤵
  PID:2644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\host\fxr
    3⤵
    PID:820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\host\fxr\6.0.27 && icacls C:\Program Files\dotnet\host\fxr\6.0.27 /grant everyone:(f)
  2⤵
  PID:4500
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\host\fxr\6.0.27
    3⤵
    PID:3672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\host\fxr\7.0.16 && icacls C:\Program Files\dotnet\host\fxr\7.0.16 /grant everyone:(f)
  2⤵
  PID:1840
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\host\fxr\7.0.16
    3⤵
    - Possible privilege escalation attempt
    PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\host\fxr\8.0.2 && icacls C:\Program Files\dotnet\host\fxr\8.0.2 /grant everyone:(f)
  2⤵
  PID:216
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\host\fxr\8.0.2
    3⤵
    PID:4392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared && icacls C:\Program Files\dotnet\shared /grant everyone:(f)
  2⤵
  PID:2468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared
    3⤵
    PID:712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App && icacls C:\Program Files\dotnet\shared\Microsoft.NETCore.App /grant everyone:(f)
  2⤵
  PID:1728
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App
    3⤵
    PID:2404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27 && icacls C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27 /grant everyone:(f)
  2⤵
  PID:4368
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27
    3⤵
    PID:2168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16 && icacls C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16 /grant everyone:(f)
  2⤵
  PID:1540
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16
    3⤵
    PID:2404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2 && icacls C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2 /grant everyone:(f)
  2⤵
  PID:3308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2
    3⤵
    PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App /grant everyone:(f)
  2⤵
  PID:4432
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App
    3⤵
    PID:1836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27 && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27 /grant everyone:(f)
  2⤵
  PID:3104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27
    3⤵
    - Modifies file permissions
    PID:2172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs /grant everyone:(f)
  2⤵
  PID:216
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs
    3⤵
    PID:4072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de /grant everyone:(f)
  2⤵
  PID:2492
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de
    3⤵
    PID:3408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es /grant everyone:(f)
  2⤵
  PID:4248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es
    3⤵
    PID:3248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr /grant everyone:(f)
  2⤵
  PID:4536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr
    3⤵
    PID:380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it /grant everyone:(f)
  2⤵
  PID:1880
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it
    3⤵
    PID:4016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja /grant everyone:(f)
  2⤵
  PID:2184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja
    3⤵
    PID:2716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko /grant everyone:(f)
  2⤵
  PID:2816
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko
    3⤵
    PID:1800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl /grant everyone:(f)
  2⤵
  PID:2172
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl
    3⤵
    PID:4496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR /grant everyone:(f)
  2⤵
  PID:1536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR
    3⤵
    PID:3308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru /grant everyone:(f)
  2⤵
  PID:5080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru
    3⤵
    PID:2312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr /grant everyone:(f)
  2⤵
  PID:2812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr
    3⤵
    - Modifies file permissions
    PID:2808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans /grant everyone:(f)
  2⤵
  PID:4552
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans
    3⤵
    PID:1092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant /grant everyone:(f)
  2⤵
  PID:1848
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant
    3⤵
    PID:2984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16 && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16 /grant everyone:(f)
  2⤵
  PID:4092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16
    3⤵
    PID:4100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs /grant everyone:(f)
  2⤵
  PID:1140
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs
    3⤵
    PID:3028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de /grant everyone:(f)
  2⤵
  PID:980
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de
    3⤵
    PID:4024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es /grant everyone:(f)
  2⤵
  PID:2956
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es
    3⤵
    PID:1468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr /grant everyone:(f)
  2⤵
  PID:4392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr
    3⤵
    PID:712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it /grant everyone:(f)
  2⤵
  PID:1544
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it
    3⤵
    PID:1292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja /grant everyone:(f)
  2⤵
  PID:4248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja
    3⤵
    PID:3272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko /grant everyone:(f)
  2⤵
  PID:1344
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko
    3⤵
    PID:2740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl /grant everyone:(f)
  2⤵
  PID:4100
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl
    3⤵
    PID:3508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR /grant everyone:(f)
  2⤵
  PID:3124
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR
    3⤵
    PID:4996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru /grant everyone:(f)
  2⤵
  PID:1192
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru
    3⤵
    - Possible privilege escalation attempt
    PID:3860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr /grant everyone:(f)
  2⤵
  PID:3868
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr
    3⤵
    PID:744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans /grant everyone:(f)
  2⤵
  PID:1536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans
    3⤵
    - Modifies file permissions
    PID:4952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant /grant everyone:(f)
  2⤵
  PID:5080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant
    3⤵
    PID:4072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2 && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2 /grant everyone:(f)
  2⤵
  PID:4764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2
    3⤵
    PID:4316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs /grant everyone:(f)
  2⤵
  PID:1444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs
    3⤵
    - Possible privilege escalation attempt
    PID:4092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de /grant everyone:(f)
  2⤵
  PID:4860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de
    3⤵
    PID:384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es /grant everyone:(f)
  2⤵
  PID:4384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es
    3⤵
    PID:3316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr /grant everyone:(f)
  2⤵
  PID:2408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr
    3⤵
    PID:5104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it /grant everyone:(f)
  2⤵
  PID:5040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it
    3⤵
    PID:220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja /grant everyone:(f)
  2⤵
  PID:956
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja
    3⤵
    PID:3284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko /grant everyone:(f)
  2⤵
  PID:2468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko
    3⤵
    PID:4584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl /grant everyone:(f)
  2⤵
  PID:952
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl
    3⤵
    PID:4180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR /grant everyone:(f)
  2⤵
  PID:3572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR
    3⤵
    PID:1248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru /grant everyone:(f)
  2⤵
  PID:3708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru
    3⤵
    PID:4768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr /grant everyone:(f)
  2⤵
  PID:4244
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr
    3⤵
    PID:3508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans /grant everyone:(f)
  2⤵
  PID:4576
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans
    3⤵
    PID:400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant /grant everyone:(f)
  2⤵
  PID:4484
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant
    3⤵
    PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\swidtag && icacls C:\Program Files\dotnet\swidtag /grant everyone:(f)
  2⤵
  PID:844
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\swidtag
    3⤵
    PID:980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google && icacls C:\Program Files\Google /grant everyone:(f)
  2⤵
  PID:4812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google
    3⤵
    PID:3684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome && icacls C:\Program Files\Google\Chrome /grant everyone:(f)
  2⤵
  PID:220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome
    3⤵
    PID:2356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application && icacls C:\Program Files\Google\Chrome\Application /grant everyone:(f)
  2⤵
  PID:1732
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application
    3⤵
    PID:3488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123 && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123 /grant everyone:(f)
  2⤵
  PID:1840
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123
    3⤵
    PID:4692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps /grant everyone:(f)
  2⤵
  PID:1688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps
    3⤵
    PID:3740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions /grant everyone:(f)
  2⤵
  PID:1544
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions
    3⤵
    PID:4060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer /grant everyone:(f)
  2⤵
  PID:2712
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer
    3⤵
    PID:3188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales /grant everyone:(f)
  2⤵
  PID:5028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales
    3⤵
    PID:2324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload /grant everyone:(f)
  2⤵
  PID:3460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload
    3⤵
    PID:4908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements /grant everyone:(f)
  2⤵
  PID:384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements
    3⤵
    PID:3124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm /grant everyone:(f)
  2⤵
  PID:1152
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm
    3⤵
    PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific /grant everyone:(f)
  2⤵
  PID:4120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific
    3⤵
    PID:3184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64 && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64 /grant everyone:(f)
  2⤵
  PID:3260
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64
    3⤵
    PID:1892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\SetupMetrics && icacls C:\Program Files\Google\Chrome\Application\SetupMetrics /grant everyone:(f)
  2⤵
  PID:4356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\SetupMetrics
    3⤵
    PID:3456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer && icacls C:\Program Files\Internet Explorer /grant everyone:(f)
  2⤵
  PID:4828
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer
    3⤵
    PID:4004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\de-DE && icacls C:\Program Files\Internet Explorer\de-DE /grant everyone:(f)
  2⤵
  PID:4868
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\de-DE
    3⤵
    PID:5008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\en-US && icacls C:\Program Files\Internet Explorer\en-US /grant everyone:(f)
  2⤵
  PID:1476
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\en-US
    3⤵
    PID:5040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\es-ES && icacls C:\Program Files\Internet Explorer\es-ES /grant everyone:(f)
  2⤵
  PID:4500
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\es-ES
    3⤵
    PID:2356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\fr-FR && icacls C:\Program Files\Internet Explorer\fr-FR /grant everyone:(f)
  2⤵
  PID:1392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\fr-FR
    3⤵
    PID:2020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\images && icacls C:\Program Files\Internet Explorer\images /grant everyone:(f)
  2⤵
  PID:956
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\images
    3⤵
    PID:4000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\it-IT && icacls C:\Program Files\Internet Explorer\it-IT /grant everyone:(f)
  2⤵
  PID:1700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\it-IT
    3⤵
    PID:5080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\ja-JP && icacls C:\Program Files\Internet Explorer\ja-JP /grant everyone:(f)
  2⤵
  PID:2036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\ja-JP
    3⤵
    PID:4692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\SIGNUP && icacls C:\Program Files\Internet Explorer\SIGNUP /grant everyone:(f)
  2⤵
  PID:4784
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\SIGNUP
    3⤵
    PID:4728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\uk-UA && icacls C:\Program Files\Internet Explorer\uk-UA /grant everyone:(f)
  2⤵
  PID:4492
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\uk-UA
    3⤵
    PID:1540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java && icacls C:\Program Files\Java /grant everyone:(f)
  2⤵
  PID:5092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java
    3⤵
    PID:1292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8 && icacls C:\Program Files\Java\jdk-1.8 /grant everyone:(f)
  2⤵
  PID:4760
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8
    3⤵
    PID:1696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\bin && icacls C:\Program Files\Java\jdk-1.8\bin /grant everyone:(f)
  2⤵
  PID:5012
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\bin
    3⤵
    PID:1356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\include && icacls C:\Program Files\Java\jdk-1.8\include /grant everyone:(f)
  2⤵
  PID:3472
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\include
    3⤵
    PID:5036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\include\win32 && icacls C:\Program Files\Java\jdk-1.8\include\win32 /grant everyone:(f)
  2⤵
  PID:3028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\include\win32
    3⤵
    PID:4820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\include\win32\bridge && icacls C:\Program Files\Java\jdk-1.8\include\win32\bridge /grant everyone:(f)
  2⤵
  PID:2508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\include\win32\bridge
    3⤵
    PID:4004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre && icacls C:\Program Files\Java\jdk-1.8\jre /grant everyone:(f)
  2⤵
  PID:3264
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre
    3⤵
    PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\bin && icacls C:\Program Files\Java\jdk-1.8\jre\bin /grant everyone:(f)
  2⤵
  PID:2384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\bin
    3⤵
    PID:1756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin && icacls C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin /grant everyone:(f)
  2⤵
  PID:4244
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin
    3⤵
    PID:1328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\plugin2 && icacls C:\Program Files\Java\jdk-1.8\jre\bin\plugin2 /grant everyone:(f)
  2⤵
  PID:3140
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\plugin2
    3⤵
    PID:1316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\server && icacls C:\Program Files\Java\jdk-1.8\jre\bin\server /grant everyone:(f)
  2⤵
  PID:4220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\server
    3⤵
    PID:4996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\legal && icacls C:\Program Files\Java\jdk-1.8\jre\legal /grant everyone:(f)
  2⤵
  PID:544
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\legal
    3⤵
    PID:4940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\legal\javafx && icacls C:\Program Files\Java\jdk-1.8\jre\legal\javafx /grant everyone:(f)
  2⤵
  PID:1380
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\legal\javafx
    3⤵
    PID:3236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\legal\jdk && icacls C:\Program Files\Java\jdk-1.8\jre\legal\jdk /grant everyone:(f)
  2⤵
  PID:3068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\legal\jdk
    3⤵
    PID:5072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib && icacls C:\Program Files\Java\jdk-1.8\jre\lib /grant everyone:(f)
  2⤵
  PID:656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib
    3⤵
    PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\amd64 && icacls C:\Program Files\Java\jdk-1.8\jre\lib\amd64 /grant everyone:(f)
  2⤵
  PID:4708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\amd64
    3⤵
    PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\applet && icacls C:\Program Files\Java\jdk-1.8\jre\lib\applet /grant everyone:(f)
  2⤵
  PID:1540
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\applet
    3⤵
    PID:3740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\cmm && icacls C:\Program Files\Java\jdk-1.8\jre\lib\cmm /grant everyone:(f)
  2⤵
  PID:1676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\cmm
    3⤵
    PID:4676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\deploy && icacls C:\Program Files\Java\jdk-1.8\jre\lib\deploy /grant everyone:(f)
  2⤵
  PID:5112
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\deploy
    3⤵
    PID:984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\ext && icacls C:\Program Files\Java\jdk-1.8\jre\lib\ext /grant everyone:(f)
  2⤵
  PID:4312
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\ext
    3⤵
    PID:4816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\fonts && icacls C:\Program Files\Java\jdk-1.8\jre\lib\fonts /grant everyone:(f)
  2⤵
  PID:3952
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\fonts
    3⤵
    PID:1280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\images && icacls C:\Program Files\Java\jdk-1.8\jre\lib\images /grant everyone:(f)
  2⤵
  PID:4100
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\images
    3⤵
    PID:2680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors && icacls C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors /grant everyone:(f)
  2⤵
  PID:4824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors
    3⤵
    PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\jfr && icacls C:\Program Files\Java\jdk-1.8\jre\lib\jfr /grant everyone:(f)
  2⤵
  PID:4308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\jfr
    3⤵
    PID:3604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\management && icacls C:\Program Files\Java\jdk-1.8\jre\lib\management /grant everyone:(f)
  2⤵
  PID:1152
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\management
    3⤵
    PID:3276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security && icacls C:\Program Files\Java\jdk-1.8\jre\lib\security /grant everyone:(f)
  2⤵
  PID:464
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security
    3⤵
    PID:4484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy && icacls C:\Program Files\Java\jdk-1.8\jre\lib\security\policy /grant everyone:(f)
  2⤵
  PID:980
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy
    3⤵
    PID:4024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited && icacls C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited /grant everyone:(f)
  2⤵
  PID:4496
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited
    3⤵
    PID:1864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited && icacls C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited /grant everyone:(f)
  2⤵
  PID:4516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited
    3⤵
    - Possible privilege escalation attempt
    PID:820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\legal && icacls C:\Program Files\Java\jdk-1.8\legal /grant everyone:(f)
  2⤵
  PID:3608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\legal
    3⤵
    PID:2020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\legal\javafx && icacls C:\Program Files\Java\jdk-1.8\legal\javafx /grant everyone:(f)
  2⤵
  PID:2860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\legal\javafx
    3⤵
    - Possible privilege escalation attempt
    PID:2956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\legal\jdk && icacls C:\Program Files\Java\jdk-1.8\legal\jdk /grant everyone:(f)
  2⤵
  PID:692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\legal\jdk
    3⤵
    PID:4692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\lib && icacls C:\Program Files\Java\jdk-1.8\lib /grant everyone:(f)
  2⤵
  PID:3196
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\lib
    3⤵
    - Possible privilege escalation attempt
    PID:3248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8 && icacls C:\Program Files\Java\jre-1.8 /grant everyone:(f)
  2⤵
  PID:2916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8
    3⤵
    PID:2212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\bin && icacls C:\Program Files\Java\jre-1.8\bin /grant everyone:(f)
  2⤵
  PID:1128
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\bin
    3⤵
    PID:4956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\bin\dtplugin && icacls C:\Program Files\Java\jre-1.8\bin\dtplugin /grant everyone:(f)
  2⤵
  PID:3672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\bin\dtplugin
    3⤵
    - Possible privilege escalation attempt
    PID:4036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\bin\plugin2 && icacls C:\Program Files\Java\jre-1.8\bin\plugin2 /grant everyone:(f)
  2⤵
  PID:4564
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\bin\plugin2
    3⤵
    PID:4796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\bin\server && icacls C:\Program Files\Java\jre-1.8\bin\server /grant everyone:(f)
  2⤵
  PID:3136
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\bin\server
    3⤵
    PID:4072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\legal && icacls C:\Program Files\Java\jre-1.8\legal /grant everyone:(f)
  2⤵
  PID:1400
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\legal
    3⤵
    PID:1696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\legal\javafx && icacls C:\Program Files\Java\jre-1.8\legal\javafx /grant everyone:(f)
  2⤵
  PID:1676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\legal\javafx
    3⤵
    PID:4076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\legal\jdk && icacls C:\Program Files\Java\jre-1.8\legal\jdk /grant everyone:(f)
  2⤵
  PID:4280
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\legal\jdk
    3⤵
    PID:3108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib && icacls C:\Program Files\Java\jre-1.8\lib /grant everyone:(f)
  2⤵
  PID:1444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib
    3⤵
    - Possible privilege escalation attempt
    PID:4736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\amd64 && icacls C:\Program Files\Java\jre-1.8\lib\amd64 /grant everyone:(f)
  2⤵
  PID:4384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\amd64
    3⤵
    PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\applet && icacls C:\Program Files\Java\jre-1.8\lib\applet /grant everyone:(f)
  2⤵
  PID:1152
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\applet
    3⤵
    PID:4460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\cmm && icacls C:\Program Files\Java\jre-1.8\lib\cmm /grant everyone:(f)
  2⤵
  PID:1192
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\cmm
    3⤵
    PID:2704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\deploy && icacls C:\Program Files\Java\jre-1.8\lib\deploy /grant everyone:(f)
  2⤵
  PID:3556
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\deploy
    3⤵
    PID:4868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\ext && icacls C:\Program Files\Java\jre-1.8\lib\ext /grant everyone:(f)
  2⤵
  PID:3264
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\ext
    3⤵
    PID:4500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\fonts && icacls C:\Program Files\Java\jre-1.8\lib\fonts /grant everyone:(f)
  2⤵
  PID:2020
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\fonts
    3⤵
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\images && icacls C:\Program Files\Java\jre-1.8\lib\images /grant everyone:(f)
  2⤵
  PID:692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\images
    3⤵
    PID:4476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\images\cursors && icacls C:\Program Files\Java\jre-1.8\lib\images\cursors /grant everyone:(f)
  2⤵
  PID:4072
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\images\cursors
    3⤵
    PID:3296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\jfr && icacls C:\Program Files\Java\jre-1.8\lib\jfr /grant everyone:(f)
  2⤵
  PID:3740
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\jfr
    3⤵
    PID:1712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\management && icacls C:\Program Files\Java\jre-1.8\lib\management /grant everyone:(f)
  2⤵
  PID:2312
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\management
    3⤵
    PID:4552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\security && icacls C:\Program Files\Java\jre-1.8\lib\security /grant everyone:(f)
  2⤵
  PID:3188
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\security
    3⤵
    PID:3272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy && icacls C:\Program Files\Java\jre-1.8\lib\security\policy /grant everyone:(f)
  2⤵
  PID:3572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy
    3⤵
    PID:4344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy\limited && icacls C:\Program Files\Java\jre-1.8\lib\security\policy\limited /grant everyone:(f)
  2⤵
  PID:1632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy\limited
    3⤵
    PID:3268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited && icacls C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited /grant everyone:(f)
  2⤵
  PID:728
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited
    3⤵
    PID:4016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office && icacls C:\Program Files\Microsoft Office /grant everyone:(f)
  2⤵
  PID:2856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office
    3⤵
    PID:3788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\Office16 && icacls C:\Program Files\Microsoft Office\Office16 /grant everyone:(f)
  2⤵
  PID:3376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\Office16
    3⤵
    PID:3508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\PackageManifests && icacls C:\Program Files\Microsoft Office\PackageManifests /grant everyone:(f)
  2⤵
  PID:5048
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\PackageManifests
    3⤵
    PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root && icacls C:\Program Files\Microsoft Office\root /grant everyone:(f)
  2⤵
  PID:224
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root
    3⤵
    - Possible privilege escalation attempt
    PID:2216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Client && icacls C:\Program Files\Microsoft Office\root\Client /grant everyone:(f)
  2⤵
  PID:3260
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Client
    3⤵
    PID:2172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16 && icacls C:\Program Files\Microsoft Office\root\Document Themes 16 /grant everyone:(f)
  2⤵
  PID:4556
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16
    3⤵
    PID:216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors && icacls C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors /grant everyone:(f)
  2⤵
  PID:3744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors
    3⤵
    - Possible privilege escalation attempt
    PID:4476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects && icacls C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects /grant everyone:(f)
  2⤵
  PID:952
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects
    3⤵
    PID:5068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts && icacls C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts /grant everyone:(f)
  2⤵
  PID:4652
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts
    3⤵
    - Possible privilege escalation attempt
    PID:2332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\fre && icacls C:\Program Files\Microsoft Office\root\fre /grant everyone:(f)
  2⤵
  PID:2624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\fre
    3⤵
    PID:4092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Integration && icacls C:\Program Files\Microsoft Office\root\Integration /grant everyone:(f)
  2⤵
  PID:1924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Integration
    3⤵
    PID:4100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Integration\Addons && icacls C:\Program Files\Microsoft Office\root\Integration\Addons /grant everyone:(f)
  2⤵
  PID:644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Integration\Addons
    3⤵
    PID:1992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Licenses && icacls C:\Program Files\Microsoft Office\root\Licenses /grant everyone:(f)
  2⤵
  PID:4940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Licenses
    3⤵
    PID:4032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Licenses16 && icacls C:\Program Files\Microsoft Office\root\Licenses16 /grant everyone:(f)
  2⤵
  PID:1156
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Licenses16
    3⤵
    PID:3860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\loc && icacls C:\Program Files\Microsoft Office\root\loc /grant everyone:(f)
  2⤵
  PID:1584
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\loc
    3⤵
    PID:3252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office15 && icacls C:\Program Files\Microsoft Office\root\Office15 /grant everyone:(f)
  2⤵
  PID:3572
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office15
    3⤵
    PID:1160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16 && icacls C:\Program Files\Microsoft Office\root\Office16 /grant everyone:(f)
  2⤵
  PID:3108
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16
    3⤵
    PID:3708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\1033 && icacls C:\Program Files\Microsoft Office\root\Office16\1033 /grant everyone:(f)
  2⤵
  PID:3316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\1033
    3⤵
    - Modifies file permissions
    PID:3184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography && icacls C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography /grant everyone:(f)
  2⤵
  PID:3700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography
    3⤵
    PID:4876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\DataServices && icacls C:\Program Files\Microsoft Office\root\Office16\1033\DataServices /grant everyone:(f)
  2⤵
  PID:3708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\DataServices
    3⤵
    PID:4792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles && icacls C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles /grant everyone:(f)
  2⤵
  PID:1552
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles
    3⤵
    PID:1280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\1036 && icacls C:\Program Files\Microsoft Office\root\Office16\1036 /grant everyone:(f)
  2⤵
  PID:384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\1036
    3⤵
    PID:3384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\3082 && icacls C:\Program Files\Microsoft Office\root\Office16\3082 /grant everyone:(f)
  2⤵
  PID:4372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\3082
    3⤵
    PID:4432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS /grant everyone:(f)
  2⤵
  PID:3316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS
    3⤵
    PID:2204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In /grant everyone:(f)
  2⤵
  PID:1156
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In
    3⤵
    PID:4484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated /grant everyone:(f)
  2⤵
  PID:3308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated
    3⤵
    PID:220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin /grant everyone:(f)
  2⤵
  PID:3684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin
    3⤵
    PID:656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in /grant everyone:(f)
  2⤵
  PID:4588
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in
    3⤵
    PID:4464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in /grant everyone:(f)
  2⤵
  PID:1472
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in
    3⤵
    PID:2008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in /grant everyone:(f)
  2⤵
  PID:1280
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in
    3⤵
    PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges /grant everyone:(f)
  2⤵
  PID:2816
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges
    3⤵
    PID:5072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en /grant everyone:(f)
  2⤵
  PID:4516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en
    3⤵
    PID:3292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources /grant everyone:(f)
  2⤵
  PID:4420
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources
    3⤵
    - Modifies file permissions
    PID:2192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033 && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033 /grant everyone:(f)
  2⤵
  PID:2608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033
    3⤵
    PID:3592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\AugLoop && icacls C:\Program Files\Microsoft Office\root\Office16\AugLoop /grant everyone:(f)
  2⤵
  PID:1968
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\AugLoop
    3⤵
    PID:1292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography && icacls C:\Program Files\Microsoft Office\root\Office16\Bibliography /grant everyone:(f)
  2⤵
  PID:1544
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography
    3⤵
    PID:1896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort && icacls C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort /grant everyone:(f)
  2⤵
  PID:1400
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort
    3⤵
    PID:2392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style && icacls C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style /grant everyone:(f)
  2⤵
  PID:3536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style
    3⤵
    PID:5016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\BORDERS && icacls C:\Program Files\Microsoft Office\root\Office16\BORDERS /grant everyone:(f)
  2⤵
  PID:4816
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\BORDERS
    3⤵
    PID:380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Configuration && icacls C:\Program Files\Microsoft Office\root\Office16\Configuration /grant everyone:(f)
  2⤵
  PID:2996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Configuration
    3⤵
    - Modifies file permissions
    PID:1328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts && icacls C:\Program Files\Microsoft Office\root\Office16\Document Parts /grant everyone:(f)
  2⤵
  PID:2964
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts
    3⤵
    PID:3940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033 && icacls C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033 /grant everyone:(f)
  2⤵
  PID:4908
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033
    3⤵
    PID:1316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16 && icacls C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16 /grant everyone:(f)
  2⤵
  PID:400
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16
    3⤵
    PID:3992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f14 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f14 /grant everyone:(f)
  2⤵
  PID:4032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f14
    3⤵
    PID:4384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f2 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f2 /grant everyone:(f)
  2⤵
  PID:1100
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f2
    3⤵
    PID:2204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f3 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f3 /grant everyone:(f)
  2⤵
  PID:2408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f3
    3⤵
    PID:4048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f33 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f33 /grant everyone:(f)
  2⤵
  PID:4268
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f33
    3⤵
    PID:3800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f4 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f4 /grant everyone:(f)
  2⤵
  PID:3540
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f4
    3⤵
    PID:4968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f7 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f7 /grant everyone:(f)
  2⤵
  PID:1536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f7
    3⤵
    PID:408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006 /grant everyone:(f)
  2⤵
  PID:220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006
    3⤵
    PID:2548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008 /grant everyone:(f)
  2⤵
  PID:4892
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008
    3⤵
    - Modifies file permissions
    PID:4764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009 /grant everyone:(f)
  2⤵
  PID:3724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009
    3⤵
    PID:3740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011 /grant everyone:(f)
  2⤵
  PID:1608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011
    3⤵
    PID:3248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050 /grant everyone:(f)
  2⤵
  PID:2060
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050
    3⤵
    PID:4488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_w1 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_w1 /grant everyone:(f)
  2⤵
  PID:4324
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_w1
    3⤵
    PID:2804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Library && icacls C:\Program Files\Microsoft Office\root\Office16\Library /grant everyone:(f)
  2⤵
  PID:2916
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Library
    3⤵
    PID:772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Library\Analysis && icacls C:\Program Files\Microsoft Office\root\Office16\Library\Analysis /grant everyone:(f)
  2⤵
  PID:1456
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Library\Analysis
    3⤵
    PID:2856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER && icacls C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER /grant everyone:(f)
  2⤵
  PID:452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER
    3⤵
    PID:4596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard && icacls C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard /grant everyone:(f)
  2⤵
  PID:2380
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard
    3⤵
    PID:1280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images && icacls C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images /grant everyone:(f)
  2⤵
  PID:2688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images
    3⤵
    PID:3736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default && icacls C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default /grant everyone:(f)
  2⤵
  PID:4380
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default
    3⤵
    PID:4448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\LogoImages && icacls C:\Program Files\Microsoft Office\root\Office16\LogoImages /grant everyone:(f)
  2⤵
  PID:3604
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\LogoImages
    3⤵
    PID:4408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MEDIA && icacls C:\Program Files\Microsoft Office\root\Office16\MEDIA /grant everyone:(f)
  2⤵
  PID:2008
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MEDIA
    3⤵
    PID:4956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC /grant everyone:(f)
  2⤵
  PID:4860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC
    3⤵
    PID:4712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar /grant everyone:(f)
  2⤵
  PID:3736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar
    3⤵
    PID:4240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg /grant everyone:(f)
  2⤵
  PID:4824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg
    3⤵
    PID:400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca /grant everyone:(f)
  2⤵
  PID:3276
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca
    3⤵
    PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs /grant everyone:(f)
  2⤵
  PID:4460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs
    3⤵
    PID:4308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\da && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\da /grant everyone:(f)
  2⤵
  PID:1140
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\da
    3⤵
    PID:2408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\de && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\de /grant everyone:(f)
  2⤵
  PID:3556
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\de
    3⤵
    PID:1072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\el && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\el /grant everyone:(f)
  2⤵
  PID:2460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\el
    3⤵
    - Possible privilege escalation attempt
    PID:4224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us /grant everyone:(f)
  2⤵
  PID:2508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us
    3⤵
    PID:2192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\es && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\es /grant everyone:(f)
  2⤵
  PID:3320
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\es
    3⤵
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\et && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\et /grant everyone:(f)
  2⤵
  PID:4796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\et
    3⤵
    PID:4892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu /grant everyone:(f)
  2⤵
  PID:4584
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu
    3⤵
    PID:2256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi /grant everyone:(f)
  2⤵
  PID:1544
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi
    3⤵
    PID:3596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr /grant everyone:(f)
  2⤵
  PID:4728
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr
    3⤵
    PID:2496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl /grant everyone:(f)
  2⤵
  PID:1092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl
    3⤵
    PID:4588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\he && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\he /grant everyone:(f)
  2⤵
  PID:5016
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\he
    3⤵
    PID:2320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi /grant everyone:(f)
  2⤵
  PID:984
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi
    3⤵
    PID:1836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr /grant everyone:(f)
  2⤵
  PID:2008
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr
    3⤵
    PID:4992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu /grant everyone:(f)
  2⤵
  PID:2512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu
    3⤵
    PID:3376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\id && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\id /grant everyone:(f)
  2⤵
  PID:1280
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\id
    3⤵
    PID:2340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\it && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\it /grant everyone:(f)
  2⤵
  PID:3460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\it
    3⤵
    PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja /grant everyone:(f)
  2⤵
  PID:3124
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja
    3⤵
    PID:1440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk /grant everyone:(f)
  2⤵
  PID:512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk
    3⤵
    PID:1848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko /grant everyone:(f)
  2⤵
  PID:2016
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko
    3⤵
    PID:3184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt /grant everyone:(f)
  2⤵
  PID:2204
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt
    3⤵
    PID:4580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv /grant everyone:(f)
  2⤵
  PID:3236
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv
    3⤵
    PID:3868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms /grant everyone:(f)
  2⤵
  PID:1656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms
    3⤵
    PID:4964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl /grant everyone:(f)
  2⤵
  PID:4828
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl
    3⤵
    PID:3264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\no && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\no /grant everyone:(f)
  2⤵
  PID:1944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\no
    3⤵
    PID:3592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl /grant everyone:(f)
  2⤵
  PID:5080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl
    3⤵
    PID:2240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt /grant everyone:(f)
  2⤵
  PID:4796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt
    3⤵
    PID:2256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR /grant everyone:(f)
  2⤵
  PID:2712
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR
    3⤵
    PID:4360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro /grant everyone:(f)
  2⤵
  PID:3740
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro
    3⤵
    PID:4248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru /grant everyone:(f)
  2⤵
  PID:1400
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru
    3⤵
    PID:1584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk /grant everyone:(f)
  2⤵
  PID:4488
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk
    3⤵
    PID:4876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl /grant everyone:(f)
  2⤵
  PID:2804
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl
    3⤵
    - Possible privilege escalation attempt
    PID:380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA /grant everyone:(f)
  2⤵
  PID:2720
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA
    3⤵
    - Possible privilege escalation attempt
    PID:2856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS /grant everyone:(f)
  2⤵
  PID:2260
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS
    3⤵
    PID:1560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS /grant everyone:(f)
  2⤵
  PID:2992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS
    3⤵
    PID:4456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv /grant everyone:(f)
  2⤵
  PID:4860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv
    3⤵
    PID:3900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\th && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\th /grant everyone:(f)
  2⤵
  PID:4804
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\th
    3⤵
    - Possible privilege escalation attempt
    PID:4380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr /grant everyone:(f)
  2⤵
  PID:3736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr
    3⤵
    PID:3996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk /grant everyone:(f)
  2⤵
  PID:2184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk
    3⤵
    PID:3780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi /grant everyone:(f)
  2⤵
  PID:4940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi
    3⤵
    PID:1268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN /grant everyone:(f)
  2⤵
  PID:4708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN
    3⤵
    PID:4376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW /grant everyone:(f)
  2⤵
  PID:3820
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW
    3⤵
    PID:3492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers /grant everyone:(f)
  2⤵
  PID:4812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers
    3⤵
    PID:4516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift /grant everyone:(f)
  2⤵
  PID:3264
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift
    3⤵
    PID:408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib /grant everyone:(f)
  2⤵
  PID:1956
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib
    3⤵
    PID:4244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA /grant everyone:(f)
  2⤵
  PID:1908
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA
    3⤵
    PID:4080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce /grant everyone:(f)
  2⤵
  PID:4584
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce
    3⤵
    PID:4720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib /grant everyone:(f)
  2⤵
  PID:1676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib
    3⤵
    PID:3740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033 && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033 /grant everyone:(f)
  2⤵
  PID:4660
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033
    3⤵
    PID:1128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA /grant everyone:(f)
  2⤵
  PID:5016
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA
    3⤵
    PID:4336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA /grant everyone:(f)
  2⤵
  PID:772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA
    3⤵
    PID:4992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA /grant everyone:(f)
  2⤵
  PID:1328
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA
    3⤵
    PID:4028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\OneNote && icacls C:\Program Files\Microsoft Office\root\Office16\OneNote /grant everyone:(f)
  2⤵
  PID:2992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\OneNote
    3⤵
    PID:3460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\osfFPA && icacls C:\Program Files\Microsoft Office\root\Office16\osfFPA /grant everyone:(f)
  2⤵
  PID:4020
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\osfFPA
    3⤵
    PID:3996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\PAGESIZE && icacls C:\Program Files\Microsoft Office\root\Office16\PAGESIZE /grant everyone:(f)
  2⤵
  PID:2800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\PAGESIZE
    3⤵
    PID:3860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\PersonaSpy && icacls C:\Program Files\Microsoft Office\root\Office16\PersonaSpy /grant everyone:(f)
  2⤵
  PID:3196
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\PersonaSpy
    3⤵
    PID:1132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\PROOF && icacls C:\Program Files\Microsoft Office\root\Office16\PROOF /grant everyone:(f)
  2⤵
  PID:4248
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\PROOF
    3⤵
    PID:2288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\QUERIES && icacls C:\Program Files\Microsoft Office\root\Office16\QUERIES /grant everyone:(f)
  2⤵
  PID:2008
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\QUERIES
    3⤵
    PID:4596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\SAMPLES && icacls C:\Program Files\Microsoft Office\root\Office16\SAMPLES /grant everyone:(f)
  2⤵
  PID:1328
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\SAMPLES
    3⤵
    PID:1444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs /grant everyone:(f)
  2⤵
  PID:4736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs
    3⤵
    - Possible privilege escalation attempt
    PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018 && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018 /grant everyone:(f)
  2⤵
  PID:3448
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018
    3⤵
    PID:384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview /grant everyone:(f)
  2⤵
  PID:4020
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview
    3⤵
    PID:5004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib /grant everyone:(f)
  2⤵
  PID:3736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib
    3⤵
    PID:4372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common /grant everyone:(f)
  2⤵
  PID:4772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common
    3⤵
    PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets /grant everyone:(f)
  2⤵
  PID:4228
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets
    3⤵
    PID:5064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027 && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027 /grant everyone:(f)
  2⤵
  PID:220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027
    3⤵
    PID:3876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets /grant everyone:(f)
  2⤵
  PID:4132
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets
    3⤵
    PID:1292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons /grant everyone:(f)
  2⤵
  PID:2712
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons
    3⤵
    - Possible privilege escalation attempt
    PID:3740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042 && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042 /grant everyone:(f)
  2⤵
  PID:3204
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042
    3⤵
    PID:1552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets /grant everyone:(f)
  2⤵
  PID:3460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets
    3⤵
    PID:4432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets /grant everyone:(f)
  2⤵
  PID:3992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets
    3⤵
    - Modifies file permissions
    PID:1440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images /grant everyone:(f)
  2⤵
  PID:1992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images
    3⤵
    PID:464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049 && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049 /grant everyone:(f)
  2⤵
  PID:4460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\SkypeSrv && icacls C:\Program Files\Microsoft Office\root\Office16\SkypeSrv /grant everyone:(f)
  2⤵
  PID:852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\SkypeSrv
    3⤵
    PID:4024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\STARTUP && icacls C:\Program Files\Microsoft Office\root\Office16\STARTUP /grant everyone:(f)
  2⤵
  PID:3684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\STARTUP
    3⤵
    PID:4964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\XLSTART && icacls C:\Program Files\Microsoft Office\root\Office16\XLSTART /grant everyone:(f)
  2⤵
  PID:3068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\XLSTART
    3⤵
    PID:3576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\rsod && icacls C:\Program Files\Microsoft Office\root\rsod /grant everyone:(f)
  2⤵
  PID:4040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\rsod
    3⤵
    PID:4244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates && icacls C:\Program Files\Microsoft Office\root\Templates /grant everyone:(f)
  2⤵
  PID:2448
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates
    3⤵
    PID:1032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\1033 && icacls C:\Program Files\Microsoft Office\root\Templates\1033 /grant everyone:(f)
  2⤵
  PID:4536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\1033
    3⤵
    - Modifies file permissions
    PID:1472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16 && icacls C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16 /grant everyone:(f)
  2⤵
  PID:1552
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16
    3⤵
    PID:3140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE && icacls C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE /grant everyone:(f)
  2⤵
  PID:5048
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE
    3⤵
    PID:1440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16 && icacls C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16 /grant everyone:(f)
  2⤵
  PID:4384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16
    3⤵
    - Possible privilege escalation attempt
    PID:464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery && icacls C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery /grant everyone:(f)
  2⤵
  PID:3628
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery
    3⤵
    PID:3856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\Presentation Designs && icacls C:\Program Files\Microsoft Office\root\Templates\Presentation Designs /grant everyone:(f)
  2⤵
  PID:4268
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\Presentation Designs
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs && icacls C:\Program Files\Microsoft Office\root\vfs /grant everyone:(f)
  2⤵
  PID:2172
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs
    3⤵
    PID:3820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData && icacls C:\Program Files\Microsoft Office\root\vfs\Common AppData /grant everyone:(f)
  2⤵
  PID:1072
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData
    3⤵
    - Modifies file permissions
    PID:5040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft && icacls C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft /grant everyone:(f)
  2⤵
  PID:1924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft
    3⤵
    PID:5044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE && icacls C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE /grant everyone:(f)
  2⤵
  PID:2192
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE
    3⤵
    PID:4244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat && icacls C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat /grant everyone:(f)
  2⤵
  PID:5080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat
    3⤵
    PID:3032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help && icacls C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help /grant everyone:(f)
  2⤵
  PID:5032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help
    3⤵
    PID:2416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Fonts && icacls C:\Program Files\Microsoft Office\root\vfs\Fonts /grant everyone:(f)
  2⤵
  PID:4720
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Fonts
    3⤵
    PID:5028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Fonts\private && icacls C:\Program Files\Microsoft Office\root\vfs\Fonts\private /grant everyone:(f)
  2⤵
  PID:4060
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Fonts\private
    3⤵
    PID:1132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64 /grant everyone:(f)
  2⤵
  PID:4456
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64
    3⤵
    PID:1444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER /grant everyone:(f)
  2⤵
  PID:3900
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER
    3⤵
    PID:3140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared /grant everyone:(f)
  2⤵
  PID:3168
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared
    3⤵
    PID:4804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW /grant everyone:(f)
  2⤵
  PID:3384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW
    3⤵
    PID:2800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION /grant everyone:(f)
  2⤵
  PID:4824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION
    3⤵
    PID:2908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033 /grant everyone:(f)
  2⤵
  PID:4952
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033
    3⤵
    PID:4820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO /grant everyone:(f)
  2⤵
  PID:3068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO
    3⤵
    PID:4828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters /grant everyone:(f)
  2⤵
  PID:1732
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters
    3⤵
    PID:4080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT /grant everyone:(f)
  2⤵
  PID:2384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT
    3⤵
    PID:1968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help /grant everyone:(f)
  2⤵
  PID:4360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help
    3⤵
    - Possible privilege escalation attempt
    PID:4340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16 /grant everyone:(f)
  2⤵
  PID:1520
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16
    3⤵
    PID:2060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033 /grant everyone:(f)
  2⤵
  PID:2352
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033
    3⤵
    PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures /grant everyone:(f)
  2⤵
  PID:3284
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures
    3⤵
    PID:1620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel /grant everyone:(f)
  2⤵
  PID:4964
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel
    3⤵
    PID:4812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges /grant everyone:(f)
  2⤵
  PID:5092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges
    3⤵
    PID:2296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources /grant everyone:(f)
  2⤵
  PID:1800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources
    3⤵
    PID:4660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033 /grant everyone:(f)
  2⤵
  PID:1584
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033
    3⤵
    PID:4464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us /grant everyone:(f)
  2⤵
  PID:3268
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us
    3⤵
    PID:1636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller /grant everyone:(f)
  2⤵
  PID:564
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller
    3⤵
    PID:1456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us /grant everyone:(f)
  2⤵
  PID:3796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us
    3⤵
    PID:1960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities /grant everyone:(f)
  2⤵
  PID:2840
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities
    3⤵
    PID:4456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF /grant everyone:(f)
  2⤵
  PID:2520
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF
    3⤵
    PID:4984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag /grant everyone:(f)
  2⤵
  PID:3500
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag
    3⤵
    PID:1440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033 /grant everyone:(f)
  2⤵
  PID:1080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033
    3⤵
    PID:4268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS /grant everyone:(f)
  2⤵
  PID:2352
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS
    3⤵
    PID:4968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033 /grant everyone:(f)
  2⤵
  PID:2172
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033
    3⤵
    PID:4516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine /grant everyone:(f)
  2⤵
  PID:4820
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine
    3⤵
    PID:4476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV /grant everyone:(f)
  2⤵
  PID:3688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV
    3⤵
    PID:3976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16 /grant everyone:(f)
  2⤵
  PID:4244
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16
    3⤵
    PID:5080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON /grant everyone:(f)
  2⤵
  PID:3172
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON
    3⤵
    - Possible privilege escalation attempt
    PID:1896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC /grant everyone:(f)
  2⤵
  PID:1132
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC
    3⤵
    PID:4988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS /grant everyone:(f)
  2⤵
  PID:3188
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS
    3⤵
    PID:924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS /grant everyone:(f)
  2⤵
  PID:2332
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS
    3⤵
    PID:1092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM /grant everyone:(f)
  2⤵
  PID:1748
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM
    3⤵
    PID:1636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT /grant everyone:(f)
  2⤵
  PID:3108
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT
    3⤵
    PID:528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI /grant everyone:(f)
  2⤵
  PID:2012
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI
    3⤵
    PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE /grant everyone:(f)
  2⤵
  PID:1444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE
    3⤵
    PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON /grant everyone:(f)
  2⤵
  PID:2688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON
    3⤵
    PID:400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES /grant everyone:(f)
  2⤵
  PID:2016
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES
    3⤵
    PID:3276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE /grant everyone:(f)
  2⤵
  PID:2816
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE
    3⤵
    PID:1080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS /grant everyone:(f)
  2⤵
  PID:3220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE /grant everyone:(f)
  2⤵
  PID:3684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE
    3⤵
    PID:4024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE /grant everyone:(f)
  2⤵
  PID:1204
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE
    3⤵
    - Modifies file permissions
    PID:3264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO /grant everyone:(f)
  2⤵
  PID:1468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO
    3⤵
    PID:2548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE /grant everyone:(f)
  2⤵
  PID:1944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE
    3⤵
    PID:3724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE /grant everyone:(f)
  2⤵
  PID:1896
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE
    3⤵
    PID:1132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN /grant everyone:(f)
  2⤵
  PID:2496
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN
    3⤵
    PID:2112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN /grant everyone:(f)
  2⤵
  PID:2212
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN
    3⤵
    PID:3572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE /grant everyone:(f)
  2⤵
  PID:4876
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE
    3⤵
    PID:1472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST /grant everyone:(f)
  2⤵
  PID:4120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST
    3⤵
    PID:4592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS /grant everyone:(f)
  2⤵
  PID:372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS
    3⤵
    PID:4456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL /grant everyone:(f)
  2⤵
  PID:4020
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL
    3⤵
    PID:4800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS /grant everyone:(f)
  2⤵
  PID:4240
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS
    3⤵
    PID:4380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL /grant everyone:(f)
  2⤵
  PID:4384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL
    3⤵
    PID:640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK /grant everyone:(f)
  2⤵
  PID:3316
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK
    3⤵
    PID:1956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS /grant everyone:(f)
  2⤵
  PID:2128
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS
    3⤵
    PID:2352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL /grant everyone:(f)
  2⤵
  PID:4108
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL
    3⤵
    PID:320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE /grant everyone:(f)
  2⤵
  PID:4356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE
    3⤵
    - Possible privilege escalation attempt
    PID:4796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD /grant everyone:(f)
  2⤵
  PID:4416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD
    3⤵
    PID:4776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL /grant everyone:(f)
  2⤵
  PID:1200
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED /grant everyone:(f)
  2⤵
  PID:1968
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED
    3⤵
    PID:724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR /grant everyone:(f)
  2⤵
  PID:3536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR
    3⤵
    PID:2324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE /grant everyone:(f)
  2⤵
  PID:1400
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE
    3⤵
    PID:3612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE /grant everyone:(f)
  2⤵
  PID:4956
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE
    3⤵
    PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN /grant everyone:(f)
  2⤵
  PID:3700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN
    3⤵
    PID:4120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY /grant everyone:(f)
  2⤵
  PID:4028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY
    3⤵
    PID:4100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE /grant everyone:(f)
  2⤵
  PID:2716
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE
    3⤵
    PID:4020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA /grant everyone:(f)
  2⤵
  PID:1796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA
    3⤵
    PID:4852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING /grant everyone:(f)
  2⤵
  PID:1152
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:640
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING
    3⤵
    PID:4744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE /grant everyone:(f)
  2⤵
  PID:3184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE
    3⤵
    - Possible privilege escalation attempt
    PID:4308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO /grant everyone:(f)
  2⤵
  PID:1140
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO
    3⤵
    PID:808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG /grant everyone:(f)
  2⤵
  PID:4324
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG
    3⤵
    PID:2608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER /grant everyone:(f)
  2⤵
  PID:4476
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER
    3⤵
    PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR /grant everyone:(f)
  2⤵
  PID:668
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR
    3⤵
    PID:1824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT /grant everyone:(f)
  2⤵
  PID:2416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT
    3⤵
    PID:1540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES /grant everyone:(f)
  2⤵
  PID:3760
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES
    3⤵
    PID:2296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR /grant everyone:(f)
  2⤵
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR
    3⤵
    PID:1632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN /grant everyone:(f)
  2⤵
  PID:1608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN
    3⤵
    PID:3272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN /grant everyone:(f)
  2⤵
  PID:2288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN
    3⤵
    PID:3572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA /grant everyone:(f)
  2⤵
  PID:1160
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA
    3⤵
    PID:2252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1 /grant everyone:(f)
  2⤵
  PID:2856
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1
    3⤵
    PID:3952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033 /grant everyone:(f)
  2⤵
  PID:3396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033
    3⤵
    PID:4860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions /grant everyone:(f)
  2⤵
  PID:4996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions
    3⤵
    PID:4800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16 /grant everyone:(f)
  2⤵
  PID:2520
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16
    3⤵
    PID:1848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN /grant everyone:(f)
  2⤵
  PID:3448
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN
    3⤵
    PID:3628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033 /grant everyone:(f)
  2⤵
  PID:1192
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033
    3⤵
    PID:3736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC /grant everyone:(f)
  2⤵
  PID:5068
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC
    3⤵
    PID:3184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources /grant everyone:(f)
  2⤵
  PID:2908
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources
    3⤵
    PID:4968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System /grant everyone:(f)
  2⤵
  PID:4408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System
    3⤵
    PID:3236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db /grant everyone:(f)
  2⤵
  PID:3684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db
    3⤵
    PID:5052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86 /grant everyone:(f)
  2⤵
  PID:4828
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86
    3⤵
    PID:3288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared /grant everyone:(f)
  2⤵
  PID:3576
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared
    3⤵
    PID:1468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION /grant everyone:(f)
  2⤵
  PID:3252
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION
    3⤵
    PID:2548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16 /grant everyone:(f)
  2⤵
  PID:1944
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16
    3⤵
    PID:3036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033 /grant everyone:(f)
  2⤵
  PID:4016
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033
    3⤵
    PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini
Size 129B
SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
MD5 a526b9e7c716b3489d8cc062fbce4005
SHA1 2df502a944ff721241be20a9e449d2acd07e0312
SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
MD5 SHA1 SHA512

Submit Download

vcredist2010_x86.log-MSI_vc_red.msi.txt

Path C:\vcredist2010_x86.log-MSI_vc_red.msi.txt
Size 18KB
SHA256 f8cfa210836847f5584567a4774da6933b8cf5019c9e7a00ebed2dfc8cca8d18
MD5 7937332bc822d91bed21841219dace0f
SHA1 5120ce678425dc0d248883611a816afdb9f398ee
SHA512 8472e84b9783400eae2dfb755ba08d98dd156a96768327f6bc62b24d1d916f4859e0f9d409ec3d86c3aea433b74f207534269cd5e1b5c631a3ac37b2ba264f44
SSDEEP 24:QSmVIZW0nXHkzNu6slRfXy3yYPNyoZObUj:5mVIZWyXHk5u6kp4ygLObUj
MD5 SHA1 SHA512 SSDEEP