c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2024, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
Size

7.7MB
MD5

c30a14b595fa334084cd32fa60b3c827
SHA1

3cd04b60b329388059cf58ce3ee6996559123cfa
SHA256

c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a
SHA512

7e244b3d45874d4cbecf53c6c404cd5681879a776b4a5710327c88d7888b61bdfafd17d462244b9ae8235955d8df148da72215ea61514c01585e4d0132ece9a8
SSDEEP

98304:YLraiumim2uZeGEWyOdLQvu6zer0NGBJMV1ZAU6tSOsN:2Imim2uZ8pvW6fAJMVd6M/N

Score

9^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Renames multiple (1574) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2588	takeown.exe
1392	takeown.exe
1076	takeown.exe
4388	takeown.exe
4452	takeown.exe
4996	takeown.exe
2596	Process not Found
2544	takeown.exe
2152	Process not Found
1520	Process not Found
3320	Process not Found
4744	takeown.exe
2188	takeown.exe
1796	takeown.exe
2448	takeown.exe
4732	Process not Found
688	Process not Found
4420	Process not Found
2480	Process not Found
1704	takeown.exe
2064	takeown.exe
400	takeown.exe
4620	Process not Found
4100	Process not Found
3936	takeown.exe
1844	takeown.exe
2348	takeown.exe
3544	Process not Found
3616	Process not Found
4140	Process not Found
748	takeown.exe
4400	takeown.exe
4944	takeown.exe
2436	takeown.exe
4280	Process not Found
1844	Process not Found
2948	Process not Found
4120	Process not Found
3912	takeown.exe
5092	takeown.exe
5076	takeown.exe
4132	takeown.exe
2212	Process not Found
3588	Process not Found
3288	Process not Found
2432	takeown.exe
1328	takeown.exe
2688	takeown.exe
3476	takeown.exe
1992	takeown.exe
3320	takeown.exe
2996	Process not Found
3696	takeown.exe
3656	takeown.exe
2344	takeown.exe
4560	takeown.exe
2940	takeown.exe
1620	Process not Found
4412	Process not Found
3728	Process not Found
4760	takeown.exe
3600	takeown.exe
2008	takeown.exe
1108	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO99LRES.DLL.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Photos.Viewer.Sequence.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Oart.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpnr.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\7-Zip\7zG.exe.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\mso98imm.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pe.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jvm.lib.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Utils.CX.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\ResetUnblock.iso.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_pt.json.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\x86\msheif_store.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\PartyChat.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\x64\msvpxenc.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp.gif.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\VVIEWDWG.DLL.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\resources.pri.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\oartim.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\vfs\SystemX86\msvcp140.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\VideoLAN\VLC\axvlc.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msolap.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingEngine.dll.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
File created	C:\Program Files\Microsoft Office\root\vreg\officemui.msi.16.en-us.vreg.dat.ghost	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4032	takeown.exe
Token: SeTakeOwnershipPrivilege	2184	takeown.exe
Token: SeTakeOwnershipPrivilege	4400	takeown.exe
Token: SeTakeOwnershipPrivilege	1580	takeown.exe
Token: SeTakeOwnershipPrivilege	4576	takeown.exe
Token: SeTakeOwnershipPrivilege	4228	takeown.exe
Token: SeTakeOwnershipPrivilege	348	takeown.exe
Token: SeTakeOwnershipPrivilege	3632	takeown.exe
Token: SeTakeOwnershipPrivilege	3792	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2716	takeown.exe
Token: SeTakeOwnershipPrivilege	4896	takeown.exe
Token: SeTakeOwnershipPrivilege	2036	takeown.exe
Token: SeTakeOwnershipPrivilege	2428	takeown.exe
Token: SeTakeOwnershipPrivilege	1512	takeown.exe
Token: SeTakeOwnershipPrivilege	3976	takeown.exe
Token: SeTakeOwnershipPrivilege	1408	takeown.exe
Token: SeTakeOwnershipPrivilege	2940	takeown.exe
Token: SeTakeOwnershipPrivilege	3028	takeown.exe
Token: SeTakeOwnershipPrivilege	1556	takeown.exe
Token: SeTakeOwnershipPrivilege	4448	takeown.exe
Token: SeTakeOwnershipPrivilege	648	takeown.exe
Token: SeTakeOwnershipPrivilege	4504	takeown.exe
Token: SeTakeOwnershipPrivilege	488	takeown.exe
Token: SeTakeOwnershipPrivilege	1576	takeown.exe
Token: SeTakeOwnershipPrivilege	1484	takeown.exe
Token: SeTakeOwnershipPrivilege	3564	takeown.exe
Token: SeTakeOwnershipPrivilege	4964	takeown.exe
Token: SeTakeOwnershipPrivilege	5004	takeown.exe
Token: SeTakeOwnershipPrivilege	2248	takeown.exe
Token: SeTakeOwnershipPrivilege	4132	takeown.exe
Token: SeTakeOwnershipPrivilege	2928	takeown.exe
Token: SeTakeOwnershipPrivilege	4996	takeown.exe
Token: SeTakeOwnershipPrivilege	3028	takeown.exe
Token: SeTakeOwnershipPrivilege	1108	takeown.exe
Token: SeTakeOwnershipPrivilege	4200	takeown.exe
Token: SeTakeOwnershipPrivilege	648	takeown.exe
Token: SeTakeOwnershipPrivilege	2540	takeown.exe
Token: SeTakeOwnershipPrivilege	1228	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	4404	takeown.exe
Token: SeTakeOwnershipPrivilege	4452	takeown.exe
Token: SeTakeOwnershipPrivilege	220	takeown.exe
Token: SeTakeOwnershipPrivilege	3936	takeown.exe
Token: SeTakeOwnershipPrivilege	3616	takeown.exe
Token: SeTakeOwnershipPrivilege	2948	takeown.exe
Token: SeTakeOwnershipPrivilege	1532	takeown.exe
Token: SeTakeOwnershipPrivilege	2544	takeown.exe
Token: SeTakeOwnershipPrivilege	3028	takeown.exe
Token: SeTakeOwnershipPrivilege	1104	takeown.exe
Token: SeTakeOwnershipPrivilege	3064	takeown.exe
Token: SeTakeOwnershipPrivilege	3320	takeown.exe
Token: SeTakeOwnershipPrivilege	2152	takeown.exe
Token: SeTakeOwnershipPrivilege	1908	takeown.exe
Token: SeTakeOwnershipPrivilege	976	takeown.exe
Token: SeTakeOwnershipPrivilege	1620	takeown.exe
Token: SeTakeOwnershipPrivilege	748	takeown.exe
Token: SeTakeOwnershipPrivilege	4620	takeown.exe
Token: SeTakeOwnershipPrivilege	400	takeown.exe
Token: SeTakeOwnershipPrivilege	3744	takeown.exe
Token: SeTakeOwnershipPrivilege	4760	takeown.exe
Token: SeTakeOwnershipPrivilege	1704	takeown.exe
Token: SeTakeOwnershipPrivilege	3912	takeown.exe
Token: SeTakeOwnershipPrivilege	4504	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1308	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	99
PID 1348 wrote to memory of 1308	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	99
PID 1308 wrote to memory of 4032	1308	cmd.exe	101
PID 1308 wrote to memory of 4032	1308	cmd.exe	101
PID 1348 wrote to memory of 904	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	102
PID 1348 wrote to memory of 904	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	102
PID 904 wrote to memory of 2184	904	cmd.exe	104
PID 904 wrote to memory of 2184	904	cmd.exe	104
PID 1348 wrote to memory of 1028	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	105
PID 1348 wrote to memory of 1028	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	105
PID 1028 wrote to memory of 4400	1028	cmd.exe	107
PID 1028 wrote to memory of 4400	1028	cmd.exe	107
PID 1348 wrote to memory of 2552	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	108
PID 1348 wrote to memory of 2552	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	108
PID 2552 wrote to memory of 1580	2552	cmd.exe	110
PID 2552 wrote to memory of 1580	2552	cmd.exe	110
PID 1348 wrote to memory of 2432	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	111
PID 1348 wrote to memory of 2432	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	111
PID 2432 wrote to memory of 4576	2432	cmd.exe	113
PID 2432 wrote to memory of 4576	2432	cmd.exe	113
PID 1348 wrote to memory of 2996	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	114
PID 1348 wrote to memory of 2996	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	114
PID 2996 wrote to memory of 4228	2996	cmd.exe	116
PID 2996 wrote to memory of 4228	2996	cmd.exe	116
PID 1348 wrote to memory of 4336	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	117
PID 1348 wrote to memory of 4336	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	117
PID 4336 wrote to memory of 348	4336	cmd.exe	119
PID 4336 wrote to memory of 348	4336	cmd.exe	119
PID 1348 wrote to memory of 2428	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	120
PID 1348 wrote to memory of 2428	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	120
PID 2428 wrote to memory of 3632	2428	cmd.exe	122
PID 2428 wrote to memory of 3632	2428	cmd.exe	122
PID 1348 wrote to memory of 1252	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	123
PID 1348 wrote to memory of 1252	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	123
PID 1252 wrote to memory of 3792	1252	cmd.exe	125
PID 1252 wrote to memory of 3792	1252	cmd.exe	125
PID 1348 wrote to memory of 3744	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	126
PID 1348 wrote to memory of 3744	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	126
PID 3744 wrote to memory of 2548	3744	cmd.exe	128
PID 3744 wrote to memory of 2548	3744	cmd.exe	128
PID 1348 wrote to memory of 2188	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	129
PID 1348 wrote to memory of 2188	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	129
PID 2188 wrote to memory of 2588	2188	cmd.exe	131
PID 2188 wrote to memory of 2588	2188	cmd.exe	131
PID 1348 wrote to memory of 4988	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	132
PID 1348 wrote to memory of 4988	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	132
PID 4988 wrote to memory of 4928	4988	cmd.exe	134
PID 4988 wrote to memory of 4928	4988	cmd.exe	134
PID 1348 wrote to memory of 4732	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	135
PID 1348 wrote to memory of 4732	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	135
PID 4732 wrote to memory of 3028	4732	cmd.exe	137
PID 4732 wrote to memory of 3028	4732	cmd.exe	137
PID 1348 wrote to memory of 3188	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	138
PID 1348 wrote to memory of 3188	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	138
PID 3188 wrote to memory of 3496	3188	cmd.exe	140
PID 3188 wrote to memory of 3496	3188	cmd.exe	140
PID 1348 wrote to memory of 4696	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	141
PID 1348 wrote to memory of 4696	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	141
PID 4696 wrote to memory of 2212	4696	cmd.exe	143
PID 4696 wrote to memory of 2212	4696	cmd.exe	143
PID 1348 wrote to memory of 436	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	144
PID 1348 wrote to memory of 436	1348	c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe	144
PID 436 wrote to memory of 4140	436	cmd.exe	146
PID 436 wrote to memory of 4140	436	cmd.exe	146

C:\Users\Admin\AppData\Local\Temp\c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
"C:\Users\Admin\AppData\Local\Temp\c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Windows\servicing\TrustedInstaller.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2184
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpnr.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpnr.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpnr.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpnr.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpnr.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpnr.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpnr.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpnr.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:348
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3792
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe"
    3⤵
    PID:2548
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe"
    3⤵
    - Modifies file permissions
    PID:2588
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe"
    3⤵
    PID:4928
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe"
    3⤵
    PID:3028
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Temp\c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Temp\c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
    3⤵
    PID:3496
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Temp\c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Temp\c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
    3⤵
    PID:2212
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Temp\c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Temp\c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
    3⤵
    PID:4140
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Temp\c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
  2⤵
  PID:1576
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Temp\c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a.exe
    3⤵
    PID:3696
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat"
  2⤵
  PID:1028
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat"
  2⤵
  PID:2552
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat"
  2⤵
  PID:1616
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4896
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat"
  2⤵
  PID:2996
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat"
  2⤵
  PID:1860
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat"
  2⤵
  PID:924
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat"
  2⤵
  PID:2012
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat"
  2⤵
  PID:2136
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1408
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat"
  2⤵
  PID:2936
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat"
  2⤵
  PID:8
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat"
  2⤵
  PID:4784
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat"
  2⤵
  PID:1304
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4448
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mraut.dll"
  2⤵
  PID:2972
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mraut.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:648
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mraut.dll"
  2⤵
  PID:3808
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mraut.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mraut.dll"
  2⤵
  PID:1816
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mraut.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:488
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mraut.dll"
  2⤵
  PID:4252
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mraut.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mraut.dll"
  2⤵
  PID:4400
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mraut.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mraut.dll"
  2⤵
  PID:3216
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mraut.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3564
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mraut.dll"
  2⤵
  PID:1620
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mraut.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mraut.dll"
  2⤵
  PID:1616
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mraut.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
  2⤵
  PID:644
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
  2⤵
  PID:1860
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
  2⤵
  PID:924
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
  2⤵
  PID:4300
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
  2⤵
  PID:968
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
  2⤵
  PID:2668
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
  2⤵
  PID:4744
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
  2⤵
  PID:2564
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:648
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
  2⤵
  PID:4696
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
  2⤵
  PID:3176
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
  2⤵
  PID:2688
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
  2⤵
  PID:2084
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4404
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"
  2⤵
  PID:4880
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"
  2⤵
  PID:2996
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:220
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"
  2⤵
  PID:4144
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"
  2⤵
  PID:4064
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat"
  2⤵
  PID:1008
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat"
  2⤵
  PID:4996
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat"
  2⤵
  PID:4928
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat"
  2⤵
  PID:4292
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
  2⤵
  PID:1076
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
  2⤵
  PID:3476
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
  2⤵
  PID:1100
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
  2⤵
  PID:4360
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
  2⤵
  PID:2184
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
  2⤵
  PID:4976
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
    3⤵
    PID:2596
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
  2⤵
  PID:2240
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
  2⤵
  PID:412
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll"
  2⤵
  PID:3684
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll"
  2⤵
  PID:2532
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4620
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll"
  2⤵
  PID:3936
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll"
  2⤵
  PID:844
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll"
  2⤵
  PID:2928
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll"
    3⤵
    - Modifies file permissions
    PID:1392
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll"
  2⤵
  PID:3312
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll"
    3⤵
    PID:4300
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll"
  2⤵
  PID:2340
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll"
    3⤵
    PID:4928
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll"
  2⤵
  PID:4732
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll"
    3⤵
    PID:1604
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
  2⤵
  PID:1400
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
  2⤵
  PID:1104
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
  2⤵
  PID:3064
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
  2⤵
  PID:2072
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll"
  2⤵
  PID:4696
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll"
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll"
  2⤵
  PID:4400
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll"
    3⤵
    PID:4824
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll"
  2⤵
  PID:4216
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll"
    3⤵
    PID:2260
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll"
  2⤵
  PID:2168
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll"
    3⤵
    PID:3216
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin"
  2⤵
  PID:4004
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin"
    3⤵
    PID:1616
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin"
  2⤵
  PID:4944
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin"
    3⤵
    PID:748
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin"
  2⤵
  PID:2784
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin"
    3⤵
    PID:2532
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin"
  2⤵
  PID:1592
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin"
    3⤵
    PID:3936
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:2928
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1480
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:4060
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:2408
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:8
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4276
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:3228
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:2108
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
  2⤵
  PID:4200
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
    3⤵
    PID:3320
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
  2⤵
  PID:4540
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
    3⤵
    PID:4256
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
  2⤵
  PID:2072
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
  2⤵
  PID:4288
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
    3⤵
    PID:3176
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
  2⤵
  PID:2688
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
    3⤵
    PID:4432
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
  2⤵
  PID:1580
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
    3⤵
    PID:2512
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
  2⤵
  PID:2084
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
    3⤵
    PID:1284
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
  2⤵
  PID:440
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll"
    3⤵
    PID:2696
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:1132
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:980
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:3632
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:400
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:776
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:2684
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1628
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"
  2⤵
  PID:1308
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"
    3⤵
    PID:1568
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"
  2⤵
  PID:2316
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"
    3⤵
    PID:2128
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"
  2⤵
  PID:2480
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"
    3⤵
    PID:1756
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"
  2⤵
  PID:116
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"
    3⤵
    PID:4428
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll"
  2⤵
  PID:1768
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll"
    3⤵
    PID:3288
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll"
  2⤵
  PID:1100
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll"
    3⤵
    - Modifies file permissions
    PID:3696
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll"
  2⤵
  PID:4360
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll"
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll"
  2⤵
  PID:4696
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll"
    3⤵
    - Modifies file permissions
    PID:4400
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\ImagingEngine.dll"
  2⤵
  PID:4896
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\ImagingEngine.dll"
    3⤵
    PID:2324
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\ImagingEngine.dll"
  2⤵
  PID:3796
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\ImagingEngine.dll"
    3⤵
    PID:4404
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\ImagingEngine.dll"
  2⤵
  PID:1620
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\ImagingEngine.dll"
    3⤵
    PID:1280
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\ImagingEngine.dll"
  2⤵
  PID:348
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\ImagingEngine.dll"
    3⤵
    PID:5072
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat"
  2⤵
  PID:2020
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat"
    3⤵
    PID:3976
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat"
  2⤵
  PID:4888
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat"
    3⤵
    PID:560
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat"
  2⤵
  PID:1944
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat"
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat"
  2⤵
  PID:3000
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat"
    3⤵
    PID:1884
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat"
  2⤵
  PID:3924
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat"
    3⤵
    PID:1568
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat"
  2⤵
  PID:3312
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat"
    3⤵
    PID:4928
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat"
  2⤵
  PID:4588
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat"
    3⤵
    - Modifies file permissions
    PID:1076
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat"
  2⤵
  PID:868
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat"
    3⤵
    - Modifies file permissions
    PID:1704
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll"
  2⤵
  PID:1516
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll"
    3⤵
    PID:2204
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll"
  2⤵
  PID:4840
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll"
    3⤵
    PID:3528
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll"
  2⤵
  PID:1156
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll"
    3⤵
    PID:4400
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll"
  2⤵
  PID:1908
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll"
    3⤵
    PID:928
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoAcq.dll"
  2⤵
  PID:2692
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoAcq.dll"
    3⤵
    PID:976
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoAcq.dll"
  2⤵
  PID:2716
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoAcq.dll"
    3⤵
    PID:412
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoAcq.dll"
  2⤵
  PID:1752
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoAcq.dll"
    3⤵
    PID:468
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoAcq.dll"
  2⤵
  PID:1296
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoAcq.dll"
    3⤵
    PID:1132
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll"
  2⤵
  PID:2532
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll"
    3⤵
    PID:2248
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll"
  2⤵
  PID:4888
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll"
    3⤵
    PID:920
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll"
  2⤵
  PID:1512
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll"
    3⤵
    PID:2136
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll"
  2⤵
  PID:5008
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll"
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Media Player\setup_wm.exe"
  2⤵
  PID:4032
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Media Player\setup_wm.exe"
    3⤵
    PID:3028
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Media Player\setup_wm.exe"
  2⤵
  PID:4928
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Media Player\setup_wm.exe"
    3⤵
    - Modifies file permissions
    PID:3600
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Media Player\setup_wm.exe"
  2⤵
  PID:1836
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Media Player\setup_wm.exe"
    3⤵
    PID:5116
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Media Player\setup_wm.exe"
  2⤵
  PID:2480
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Media Player\setup_wm.exe"
    3⤵
    PID:4340
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll"
  2⤵
  PID:448
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll"
    3⤵
    PID:1228
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll"
  2⤵
  PID:2204
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll"
    3⤵
    PID:3528
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll"
  2⤵
  PID:2072
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll"
    3⤵
    PID:2772
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll"
  2⤵
  PID:4288
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll"
    3⤵
    PID:1028
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Media Player\setup_wm.exe"
  2⤵
  PID:4252
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Media Player\setup_wm.exe"
    3⤵
    PID:4896
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Media Player\setup_wm.exe"
  2⤵
  PID:2584
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Media Player\setup_wm.exe"
    3⤵
    - Modifies file permissions
    PID:2432
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Media Player\setup_wm.exe"
  2⤵
  PID:412
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Media Player\setup_wm.exe"
    3⤵
    PID:1292
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Media Player\setup_wm.exe"
  2⤵
  PID:2696
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Media Player\setup_wm.exe"
    3⤵
    PID:2160
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll"
  2⤵
  PID:2428
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll"
    3⤵
    PID:400
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll"
  2⤵
  PID:776
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll"
    3⤵
    PID:4064
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll"
  2⤵
  PID:5092
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll"
    3⤵
    PID:1728
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll"
  2⤵
  PID:4996
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll"
    3⤵
    PID:2424
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\micaut.dll"
  2⤵
  PID:5008
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\micaut.dll"
    3⤵
    PID:968
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\micaut.dll"
  2⤵
  PID:4276
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\micaut.dll"
    3⤵
    PID:3948
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\micaut.dll"
  2⤵
  PID:2108
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\micaut.dll"
    3⤵
    - Modifies file permissions
    PID:4388
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\micaut.dll"
  2⤵
  PID:5116
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\micaut.dll"
    3⤵
    PID:3064
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll"
  2⤵
  PID:3288
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll"
    3⤵
    - Modifies file permissions
    PID:1328
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll"
  2⤵
  PID:1228
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll"
    3⤵
    PID:4284
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll"
  2⤵
  PID:1516
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll"
    3⤵
    PID:2772
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll"
  2⤵
  PID:4840
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll"
    3⤵
    PID:2904
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
  2⤵
  PID:4288
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
    3⤵
    PID:5096
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
  2⤵
  PID:1908
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
    3⤵
    PID:3200
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
  2⤵
  PID:2260
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
  2⤵
  PID:1292
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
    3⤵
    - Modifies file permissions
    PID:4944
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll"
  2⤵
  PID:3304
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll"
    3⤵
    PID:4160
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll"
  2⤵
  PID:1624
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll"
    3⤵
    PID:4220
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll"
  2⤵
  PID:844
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll"
    3⤵
    PID:1532
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll"
  2⤵
  PID:4624
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll"
    3⤵
    PID:1384
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mip.exe"
  2⤵
  PID:1480
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mip.exe"
    3⤵
    PID:4060
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mip.exe"
  2⤵
  PID:2668
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mip.exe"
    3⤵
    PID:2064
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mip.exe"
  2⤵
  PID:4760
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mip.exe"
    3⤵
    PID:2316
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mip.exe"
  2⤵
  PID:2256
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mip.exe"
    3⤵
    PID:3656
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"
  2⤵
  PID:1724
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"
    3⤵
    PID:1208
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"
  2⤵
  PID:488
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"
    3⤵
    PID:2152
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"
  2⤵
  PID:904
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"
  2⤵
  PID:3124
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"
    3⤵
    PID:1612
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
  2⤵
  PID:1212
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
    3⤵
    PID:4824
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
  2⤵
  PID:3672
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
    3⤵
    PID:928
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
  2⤵
  PID:4820
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
    3⤵
    PID:3216
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
  2⤵
  PID:4316
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll"
    3⤵
    - Modifies file permissions
    PID:4452
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll"
  2⤵
  PID:1616
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll"
    3⤵
    PID:348
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll"
  2⤵
  PID:748
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll"
    3⤵
    PID:5072
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll"
  2⤵
  PID:3316
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll"
    3⤵
    PID:3632
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll"
  2⤵
  PID:1072
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll"
    3⤵
    PID:3936
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat"
  2⤵
  PID:2280
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat"
    3⤵
    PID:4888
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat"
  2⤵
  PID:4592
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat"
    3⤵
    PID:2652
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat"
  2⤵
  PID:4996
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat"
    3⤵
    PID:3708
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat"
  2⤵
  PID:3276
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat"
    3⤵
    - Modifies file permissions
    PID:1844
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll"
  2⤵
  PID:4292
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll"
    3⤵
    PID:3948
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll"
  2⤵
  PID:3600
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll"
    3⤵
    - Modifies file permissions
    PID:3656
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll"
  2⤵
  PID:1132
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll"
    3⤵
    PID:3064
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll"
  2⤵
  PID:1724
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll"
    3⤵
    PID:4356
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\micaut.dll"
  2⤵
  PID:3176
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\micaut.dll"
    3⤵
    PID:3496
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\micaut.dll"
  2⤵
  PID:4768
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\micaut.dll"
    3⤵
    PID:4432
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\micaut.dll"
  2⤵
  PID:4696
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\micaut.dll"
    3⤵
    - Modifies file permissions
    PID:2688
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\micaut.dll"
  2⤵
  PID:4840
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\micaut.dll"
    3⤵
    PID:4896
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll"
  2⤵
  PID:3684
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll"
    3⤵
    PID:4880
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll"
  2⤵
  PID:1752
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll"
    3⤵
    PID:4280
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll"
  2⤵
  PID:4540
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll"
    3⤵
    PID:3616
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll"
  2⤵
  PID:3800
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll"
    3⤵
    PID:3936
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
  2⤵
  PID:1152
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
    3⤵
    PID:924
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
  2⤵
  PID:2928
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
    3⤵
    PID:492
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
  2⤵
  PID:4172
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
  2⤵
  PID:2668
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
    3⤵
    PID:1308
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
  2⤵
  PID:4928
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
    3⤵
    PID:4292
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
  2⤵
  PID:2256
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
    3⤵
    - Modifies file permissions
    PID:4744
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
  2⤵
  PID:4428
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
    3⤵
    PID:3064
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
  2⤵
  PID:3912
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll"
    3⤵
    - Modifies file permissions
    PID:3476
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\ado\msado15.dll"
  2⤵
  PID:4504
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\ado\msado15.dll"
    3⤵
    PID:228
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\ado\msado15.dll"
  2⤵
  PID:1612
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\ado\msado15.dll"
    3⤵
    - Modifies file permissions
    PID:2188
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\ado\msado15.dll"
  2⤵
  PID:1692
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\ado\msado15.dll"
    3⤵
    PID:4140
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\ado\msado15.dll"
  2⤵
  PID:4216
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\ado\msado15.dll"
    3⤵
    PID:4288
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt"
  2⤵
  PID:2036
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt"
    3⤵
    PID:440
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt"
  2⤵
  PID:4964
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt"
    3⤵
    PID:2692
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt"
  2⤵
  PID:3248
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt"
    3⤵
    PID:980
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt"
  2⤵
  PID:2696
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt"
    3⤵
    PID:4336
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt"
  2⤵
  PID:4848
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt"
    3⤵
    PID:3232
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt"
  2⤵
  PID:4044
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt"
    3⤵
    PID:1680
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt"
  2⤵
  PID:3936
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt"
    3⤵
    PID:1592
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt"
  2⤵
  PID:3544
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt"
    3⤵
    PID:2012
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
  2⤵
  PID:2548
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
    3⤵
    PID:3340
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
  2⤵
  PID:2928
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
    3⤵
    PID:1400
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
  2⤵
  PID:1568
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
    3⤵
    PID:3276
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
  2⤵
  PID:5008
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
    3⤵
    PID:1364
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll"
  2⤵
  PID:2128
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll"
    3⤵
    PID:3320
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll"
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll"
    3⤵
    PID:1132
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll"
  2⤵
  PID:4200
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll"
    3⤵
    PID:4556
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll"
  2⤵
  PID:840
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll"
    3⤵
    PID:4752
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll"
  2⤵
  PID:2596
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll"
    3⤵
    PID:4884
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll"
  2⤵
  PID:2352
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll"
    3⤵
    PID:4404
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll"
  2⤵
  PID:4696
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll"
    3⤵
    PID:848
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll"
  2⤵
  PID:4820
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll"
    3⤵
    PID:4004
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\imjplm.dll"
  2⤵
  PID:5004
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\imjplm.dll"
    3⤵
    PID:3552
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\imjplm.dll"
  2⤵
  PID:3248
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\imjplm.dll"
    3⤵
    PID:4596
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\imjplm.dll"
  2⤵
  PID:2696
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\imjplm.dll"
    3⤵
    PID:1252
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\imjplm.dll"
  2⤵
  PID:3232
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\imjplm.dll"
    3⤵
    PID:4540
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll"
  2⤵
  PID:1680
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll"
    3⤵
    PID:1956
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll"
  2⤵
  PID:2136
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll"
    3⤵
    PID:2040
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll"
  2⤵
  PID:4972
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll"
    3⤵
    PID:4300
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll"
  2⤵
  PID:2448
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll"
    3⤵
    PID:4616
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
  2⤵
  PID:2340
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
    3⤵
    PID:1844
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
  2⤵
  PID:2940
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
    3⤵
    PID:5060
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
  2⤵
  PID:3656
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
    3⤵
    PID:1108
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
  2⤵
  PID:1556
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
    3⤵
    PID:1132
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
  2⤵
  PID:2200
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
    3⤵
    PID:3476
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
  2⤵
  PID:3032
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
    3⤵
    PID:1936
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
  2⤵
  PID:1768
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
  2⤵
  PID:2552
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll"
    3⤵
    PID:4140
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\ado\msado15.dll"
  2⤵
  PID:4768
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\ado\msado15.dll"
    3⤵
    PID:4216
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\ado\msado15.dll"
  2⤵
  PID:848
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\ado\msado15.dll"
    3⤵
    PID:2036
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\ado\msado15.dll"
  2⤵
  PID:4820
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\ado\msado15.dll"
    3⤵
    PID:2996
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\ado\msado15.dll"
  2⤵
  PID:2920
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\ado\msado15.dll"
    3⤵
    PID:4880
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll"
  2⤵
  PID:3248
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll"
    3⤵
    PID:1252
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll"
  2⤵
  PID:556
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll"
    3⤵
    PID:2020
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll"
  2⤵
  PID:4144
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll"
    3⤵
    PID:1408
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll"
  2⤵
  PID:1956
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll"
    3⤵
    PID:4888
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwLatin.dll"
  2⤵
  PID:1604
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwLatin.dll"
    3⤵
    PID:2652
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwLatin.dll"
  2⤵
  PID:1944
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwLatin.dll"
    3⤵
    PID:3360
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwLatin.dll"
  2⤵
  PID:3708
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwLatin.dll"
    3⤵
    - Modifies file permissions
    PID:1992
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwLatin.dll"
  2⤵
  PID:3740
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwLatin.dll"
    3⤵
    PID:628
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
  2⤵
  PID:5008
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
    3⤵
    PID:4744
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
  2⤵
  PID:2320
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
    3⤵
    PID:3696
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
  2⤵
  PID:2176
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
    3⤵
    PID:1724
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
  2⤵
  PID:3584
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll"
    3⤵
    PID:3212
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin
  2⤵
  PID:4836
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin
    3⤵
    PID:3176
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin
  2⤵
  PID:2204
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin
    3⤵
    PID:1212
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin
  2⤵
  PID:2596
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin
    3⤵
    PID:4420
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin
  2⤵
  PID:4796
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin
    3⤵
    PID:5096
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db
  2⤵
  PID:848
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db
    3⤵
    PID:2184
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db
  2⤵
  PID:2996
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db
    3⤵
    PID:1292
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db
  2⤵
  PID:748
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db
    3⤵
    PID:1252
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db
  2⤵
  PID:4824
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db
    3⤵
    PID:556
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll"
  2⤵
  PID:920
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll"
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll"
  2⤵
  PID:1044
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll"
    3⤵
    PID:1604
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll"
  2⤵
  PID:1152
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll"
    3⤵
    PID:492
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll"
  2⤵
  PID:4616
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll"
    3⤵
    PID:1480
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat"
  2⤵
  PID:628
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat"
    3⤵
    PID:4340
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat"
  2⤵
  PID:1704
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat"
    3⤵
    PID:3012
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat"
  2⤵
  PID:3948
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat"
    3⤵
    PID:488
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat"
  2⤵
  PID:4448
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat"
    3⤵
    PID:3808
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt"
  2⤵
  PID:3124
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt"
    3⤵
    PID:4844
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt"
  2⤵
  PID:1564
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt"
    3⤵
    PID:2552
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt"
  2⤵
  PID:4404
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt"
    3⤵
    PID:1524
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt"
  2⤵
  PID:4840
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt"
    3⤵
    PID:2324
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt"
  2⤵
  PID:4796
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt"
    3⤵
    PID:980
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt"
  2⤵
  PID:2036
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt"
    3⤵
    PID:976
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt"
  2⤵
  PID:348
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt"
    3⤵
    PID:4280
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt"
  2⤵
  PID:1732
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt"
    3⤵
    PID:2764
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll"
  2⤵
  PID:3744
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll"
    3⤵
    PID:1408
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll"
  2⤵
  PID:2136
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll"
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll"
  2⤵
  PID:4624
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll"
    3⤵
    PID:1044
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll"
  2⤵
  PID:1944
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll"
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
  2⤵
  PID:3028
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
    3⤵
    PID:1284
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
  2⤵
  PID:1844
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
    3⤵
    PID:1364
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
  2⤵
  PID:4292
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
    3⤵
    PID:3320
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
  2⤵
  PID:4428
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
    3⤵
    PID:1108
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\wab32res.dll"
  2⤵
  PID:2320
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\wab32res.dll"
    3⤵
    PID:736
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32res.dll"
  2⤵
  PID:4788
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32res.dll"
    3⤵
    PID:3584
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\wab32res.dll"
  2⤵
  PID:1624
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\wab32res.dll"
    3⤵
    PID:3756
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32res.dll"
  2⤵
  PID:2540
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32res.dll"
    3⤵
    PID:3176
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32res.dll"
  2⤵
  PID:4884
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32res.dll"
    3⤵
    PID:744
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32res.dll"
  2⤵
  PID:1028
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32res.dll"
    3⤵
    PID:3160
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\wab32res.dll"
  2⤵
  PID:2128
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\wab32res.dll"
    3⤵
    PID:4572
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\wab32res.dll"
  2⤵
  PID:1616
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\wab32res.dll"
    3⤵
    PID:2168
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll"
  2⤵
  PID:2344
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll"
    3⤵
    PID:3976
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll"
  2⤵
  PID:4280
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll"
    3⤵
    PID:1072
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll"
  2⤵
  PID:2764
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll"
    3⤵
    PID:3936
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll"
  2⤵
  PID:4044
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll"
    3⤵
    PID:1384
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Media Player\wmpnetwk.exe"
  2⤵
  PID:1860
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    3⤵
    PID:2784
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Media Player\wmpnetwk.exe"
  2⤵
  PID:2652
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    3⤵
    PID:4828
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Media Player\wmpnetwk.exe"
  2⤵
  PID:1512
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows Media Player\wmpnetwk.exe"
  2⤵
  PID:4172
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    3⤵
    PID:4444
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\oledb32.dll"
  2⤵
  PID:4032
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\oledb32.dll"
    3⤵
    PID:5072
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\oledb32.dll"
  2⤵
  PID:3600
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\oledb32.dll"
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\oledb32.dll"
  2⤵
  PID:1108
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\oledb32.dll"
    3⤵
    PID:1492
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\oledb32.dll"
  2⤵
  PID:2972
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\oledb32.dll"
    3⤵
    PID:3808
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\wab32.dll"
  2⤵
  PID:228
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\wab32.dll"
    3⤵
    PID:3748
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\wab32.dll"
  2⤵
  PID:3176
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\wab32.dll"
    3⤵
    PID:2212
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\wab32.dll"
  2⤵
  PID:2436
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\wab32.dll"
    3⤵
    PID:4396
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\wab32.dll"
  2⤵
  PID:4404
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\wab32.dll"
    3⤵
    PID:4964
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.dll"
  2⤵
  PID:4840
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.dll"
    3⤵
    PID:1296
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.dll"
  2⤵
  PID:2716
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.dll"
    3⤵
    PID:412
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.dll"
  2⤵
  PID:1292
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.dll"
    3⤵
    PID:2512
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.dll"
  2⤵
  PID:4540
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.dll"
    3⤵
    PID:1072
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
  2⤵
  PID:4972
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
    3⤵
    PID:1508
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
  2⤵
  PID:468
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
    3⤵
    PID:4948
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
  2⤵
  PID:2652
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
    3⤵
    PID:2548
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
  2⤵
  PID:4512
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll"
    3⤵
    PID:2928
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:3320
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:628
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2408
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:4784
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:1836
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:2200
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:5116
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll"
  2⤵
  PID:3756
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll"
    3⤵
    PID:4836
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll"
  2⤵
  PID:228
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll"
    3⤵
    PID:2552
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll"
  2⤵
  PID:2688
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll"
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll"
  2⤵
  PID:3420
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll"
    3⤵
    PID:3672
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll"
  2⤵
  PID:928
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll"
    3⤵
    PID:2168
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll"
  2⤵
  PID:1616
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll"
    3⤵
    PID:2036
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll"
  2⤵
  PID:3520
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll"
    3⤵
    PID:4132
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll"
  2⤵
  PID:2696
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll"
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"
  2⤵
  PID:1728
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"
    3⤵
    PID:4888
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"
  2⤵
  PID:2040
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"
    3⤵
    - Modifies file permissions
    PID:1796
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"
  2⤵
  PID:844
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"
    3⤵
    PID:2064
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"
  2⤵
  PID:4944
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"
    3⤵
    PID:1992
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.dll"
  2⤵
  PID:1568
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.dll"
    3⤵
    PID:3900
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.dll"
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.dll"
    3⤵
    PID:4428
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.dll"
  2⤵
  PID:868
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.dll"
    3⤵
    PID:1492
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.dll"
  2⤵
  PID:2108
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.dll"
    3⤵
    PID:2592
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32.dll"
  2⤵
  PID:1936
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32.dll"
    3⤵
    PID:4752
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32.dll"
  2⤵
  PID:3756
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32.dll"
    3⤵
    PID:2072
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32.dll"
  2⤵
  PID:228
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32.dll"
    3⤵
    PID:2960
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32.dll"
  2⤵
  PID:4692
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\wab32.dll"
    3⤵
    - Modifies file permissions
    PID:2348
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe"
  2⤵
  PID:4576
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe"
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe"
  2⤵
  PID:3200
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe"
    3⤵
    - Modifies file permissions
    PID:2344
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe"
  2⤵
  PID:4596
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe"
    3⤵
    PID:1292
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe"
  2⤵
  PID:348
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe"
    3⤵
    PID:2012
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
  2⤵
  PID:2696
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
    3⤵
    PID:3988
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
  2⤵
  PID:560
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
    3⤵
    PID:1728
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
  2⤵
  PID:1628
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
    3⤵
    PID:3660
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
  2⤵
  PID:4948
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
    3⤵
    - Modifies file permissions
    PID:2064
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\msdasql.dll"
  2⤵
  PID:3252
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\msdasql.dll"
    3⤵
    PID:1944
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\msdasql.dll"
  2⤵
  PID:2968
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\msdasql.dll"
    3⤵
    PID:3736
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\msdasql.dll"
  2⤵
  PID:2928
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\msdasql.dll"
    3⤵
    PID:2096
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\msdasql.dll"
  2⤵
  PID:3312
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\Ole DB\msdasql.dll"
    3⤵
    PID:3320
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\msadc\msadce.dll"
  2⤵
  PID:1108
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\msadc\msadce.dll"
    3⤵
    PID:1492
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\msadc\msadce.dll"
  2⤵
  PID:116
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\msadc\msadce.dll"
    3⤵
    PID:4928
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\msadc\msadce.dll"
  2⤵
  PID:2320
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\msadc\msadce.dll"
    3⤵
    - Modifies file permissions
    PID:5092
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\System\msadc\msadce.dll"
  2⤵
  PID:4016
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\System\msadc\msadce.dll"
    3⤵
    PID:1580
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
  2⤵
  PID:3756
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
    3⤵
    PID:4208
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
  2⤵
  PID:2688
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
    3⤵
    PID:4420
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
  2⤵
  PID:3420
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
    3⤵
    PID:4572
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
  2⤵
  PID:5004
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
    3⤵
    PID:1716
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
  2⤵
  PID:3200
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
    3⤵
    PID:1752
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
  2⤵
  PID:220
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
    3⤵
    PID:456
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
  2⤵
  PID:2648
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
    3⤵
    PID:3744
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
  2⤵
  PID:1408
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll"
    3⤵
    PID:2136
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
  2⤵
  PID:2532
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
  2⤵
  PID:1628
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
    3⤵
    - Modifies file permissions
    PID:5076
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
  2⤵
  PID:2864
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
    3⤵
    PID:2548
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
  2⤵
  PID:3848
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
  2⤵
  PID:3736
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
    3⤵
    PID:4340
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
  2⤵
  PID:2096
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
    3⤵
    PID:1920
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
  2⤵
  PID:4484
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
    3⤵
    PID:4356
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
  2⤵
  PID:3260
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll"
    3⤵
    PID:2564
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll"
  2⤵
  PID:1576
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll"
    3⤵
    PID:4360
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll"
  2⤵
  PID:1104
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll"
    3⤵
    PID:3748
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll"
  2⤵
  PID:1768
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll"
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll"
  2⤵
  PID:2308
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll"
    3⤵
    PID:2960
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll"
  2⤵
  PID:1692
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll"
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll"
  2⤵
  PID:4288
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll"
    3⤵
    PID:4228
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll"
  2⤵
  PID:4572
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll"
    3⤵
    PID:2992
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll"
  2⤵
  PID:2036
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll"
    3⤵
    PID:2344
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
  2⤵
  PID:1616
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
    3⤵
    PID:4132
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
  2⤵
  PID:456
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
    3⤵
    PID:3728
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
  2⤵
  PID:4488
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
    3⤵
    PID:4900
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
  2⤵
  PID:2212
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
    3⤵
    PID:3660
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
  2⤵
  PID:180
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
    3⤵
    PID:1228
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
  2⤵
  PID:3536
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
    3⤵
    PID:2548
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
  2⤵
  PID:1152
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
    3⤵
    PID:968
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
  2⤵
  PID:3252
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll"
    3⤵
    PID:4292
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll"
  2⤵
  PID:628
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll"
    3⤵
    PID:3312
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll"
  2⤵
  PID:4352
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll"
    3⤵
    PID:4500
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll"
  2⤵
  PID:1836
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll"
    3⤵
    PID:3260
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll"
  2⤵
  PID:2972
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll"
    3⤵
    PID:2480
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
  2⤵
  PID:4752
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
    3⤵
    PID:4432
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
  2⤵
  PID:3216
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
    3⤵
    PID:4908
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
  2⤵
  PID:4884
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
    3⤵
    PID:436
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
  2⤵
  PID:4208
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
    3⤵
    PID:2240
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
  2⤵
  PID:4420
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
    3⤵
    - Modifies file permissions
    PID:2008
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
  2⤵
  PID:2716
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
    3⤵
    - Modifies file permissions
    PID:4560
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
  2⤵
  PID:1084
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
    3⤵
    PID:1816
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
  2⤵
  PID:1752
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll"
    3⤵
    PID:3304
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextService.dll"
  2⤵
  PID:2280
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextService.dll"
    3⤵
    PID:4468
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextService.dll"
  2⤵
  PID:1408
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextService.dll"
    3⤵
    PID:4044
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextService.dll"
  2⤵
  PID:644
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextService.dll"
    3⤵
    PID:1044
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextService.dll"
  2⤵
  PID:1508
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Windows NT\TableTextService\TableTextService.dll"
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll"
  2⤵
  PID:1520
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll"
    3⤵
    PID:2668
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll"
  2⤵
  PID:1392
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll"
    3⤵
    PID:2164
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll"
  2⤵
  PID:3848
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll"
    3⤵
    PID:3656
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll"
  2⤵
  PID:4460
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll"
    3⤵
    PID:4744
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
  2⤵
  PID:1108
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
    3⤵
    PID:4360
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
  2⤵
  PID:3808
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
    3⤵
    PID:1624
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
  2⤵
  PID:2552
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
    3⤵
    PID:4140
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
  2⤵
  PID:1768
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll"
    3⤵
    PID:3796
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
  2⤵
  PID:3288
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
    3⤵
    PID:228
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
  2⤵
  PID:1620
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
    3⤵
    PID:3756
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
  2⤵
  PID:4228
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
    3⤵
    PID:464
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
  2⤵
  PID:3632
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
    3⤵
    PID:2716
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat
  2⤵
  PID:4368
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat
    3⤵
    - Modifies file permissions
    PID:4132
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat
  2⤵
  PID:3304
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat
    3⤵
    PID:2012
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat
  2⤵
  PID:220
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat
    3⤵
    PID:1956
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat
  2⤵
  PID:1608
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat
    3⤵
    PID:3232
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll"
  2⤵
  PID:2948
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll"
    3⤵
    PID:1604
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll"
  2⤵
  PID:1228
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll"
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll"
  2⤵
  PID:3708
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll"
    3⤵
    PID:3960
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll"
  2⤵
  PID:3740
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll"
    3⤵
    PID:3296
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\msdasql.dll"
  2⤵
  PID:2256
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\msdasql.dll"
    3⤵
    PID:2928
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\msdasql.dll"
  2⤵
  PID:4800
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\msdasql.dll"
    3⤵
    PID:3696
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\msdasql.dll"
  2⤵
  PID:8
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\msdasql.dll"
    3⤵
    PID:3600
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\msdasql.dll"
  2⤵
  PID:1836
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\Ole DB\msdasql.dll"
    3⤵
    PID:4360
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll"
  2⤵
  PID:4624
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll"
    3⤵
    PID:2056
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll"
  2⤵
  PID:2960
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll"
    3⤵
    PID:4956
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll"
  2⤵
  PID:4836
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll"
    3⤵
    PID:4840
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll"
  2⤵
  PID:3160
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll"
    3⤵
    PID:2904
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll"
  2⤵
  PID:2008
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll"
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll"
  2⤵
  PID:4912
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll"
    3⤵
    PID:1816
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll"
  2⤵
  PID:2996
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll"
    3⤵
    PID:3520
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll"
  2⤵
  PID:4824
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll"
    3⤵
    PID:2764
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll"
  2⤵
  PID:348
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll"
    3⤵
    PID:2136
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll"
  2⤵
  PID:1384
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll"
    3⤵
    PID:560
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll"
  2⤵
  PID:3660
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll"
    3⤵
    PID:4940
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll"
  2⤵
  PID:1604
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll"
    3⤵
    - Modifies file permissions
    PID:4996
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\msadc\msadce.dll"
  2⤵
  PID:4616
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\msadc\msadce.dll"
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\msadc\msadce.dll"
  2⤵
  PID:4292
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\msadc\msadce.dll"
    3⤵
    PID:1308
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\msadc\msadce.dll"
  2⤵
  PID:4060
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\msadc\msadce.dll"
    3⤵
    PID:1704
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\System\msadc\msadce.dll"
  2⤵
  PID:2940
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\System\msadc\msadce.dll"
    3⤵
    PID:3320
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
  2⤵
  PID:3188
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
    3⤵
    PID:3948
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
  2⤵
  PID:3260
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
    3⤵
    PID:4504
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
  2⤵
  PID:4200
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
    3⤵
    PID:2540
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
  2⤵
  PID:1328
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
    3⤵
    PID:1484
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
  2⤵
  PID:1212
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
    3⤵
    - Modifies file permissions
    PID:400
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
  2⤵
  PID:4208
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
    3⤵
    PID:4840
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
  2⤵
  PID:4404
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
    3⤵
    - Modifies file permissions
    PID:2436
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
  2⤵
  PID:4228
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll"
    3⤵
    PID:4560
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin
  2⤵
  PID:1252
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin
    3⤵
    PID:3200
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin
  2⤵
  PID:1732
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin
    3⤵
    PID:3304
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin
  2⤵
  PID:920
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin
    3⤵
    PID:492
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin
  2⤵
  PID:2136
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin
    3⤵
    PID:4972
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll"
  2⤵
  PID:1628
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll"
    3⤵
    PID:4940
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll"
  2⤵
  PID:3340
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll"
    3⤵
    PID:2948
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll"
  2⤵
  PID:4528
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll"
    3⤵
    PID:1520
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll"
  2⤵
  PID:3792
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll"
    3⤵
    PID:5072
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat"
  2⤵
  PID:3848
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat"
    3⤵
    PID:1568
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat"
  2⤵
  PID:628
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat"
    3⤵
    - Modifies file permissions
    PID:3320
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat"
  2⤵
  PID:1100
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat"
    3⤵
    PID:8
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat"
  2⤵
  PID:3188
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat"
    3⤵
    PID:4788
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll"
  2⤵
  PID:4752
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll"
    3⤵
    PID:2308
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll"
  2⤵
  PID:4376
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll"
    3⤵
    PID:1484
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll"
  2⤵
  PID:2352
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll"
    3⤵
    PID:1212
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll"
  2⤵
  PID:3672
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll"
    3⤵
    PID:4412
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll"
  2⤵
  PID:4444
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll"
    3⤵
    PID:848
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll"
  2⤵
  PID:4964
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll"
    3⤵
    PID:4220
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll"
  2⤵
  PID:556
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll"
    3⤵
    PID:4064
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll"
  2⤵
  PID:4368
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll"
    3⤵
    PID:1616
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
  2⤵
  PID:748
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
    3⤵
    PID:3728
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
  2⤵
  PID:348
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
    3⤵
    PID:1956
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
  2⤵
  PID:1884
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
    3⤵
    PID:2212
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
  2⤵
  PID:4940
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
    3⤵
    - Modifies file permissions
    PID:2448
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
  2⤵
  PID:4120
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
    3⤵
    PID:2432
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
  2⤵
  PID:5008
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
    3⤵
    PID:3792
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
  2⤵
  PID:3296
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
    3⤵
    PID:3900
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
  2⤵
  PID:1724
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll"
    3⤵
    - Modifies file permissions
    PID:2940
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll"
  2⤵
  PID:3948
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll"
    3⤵
    PID:1100
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll"
  2⤵
  PID:1836
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll"
    3⤵
    PID:3188
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll"
  2⤵
  PID:648
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll"
    3⤵
    PID:3212
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll"
  2⤵
  PID:4752
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll"
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
  2⤵
  PID:4004
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
    3⤵
    PID:2352
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
  2⤵
  PID:232
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
    3⤵
    PID:2688
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
  2⤵
  PID:2584
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
    3⤵
    PID:2128
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
  2⤵
  PID:4796
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
    3⤵
    PID:4160
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
  2⤵
  PID:2036
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
    3⤵
    PID:2544
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
  2⤵
  PID:1252
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
    3⤵
    PID:1072
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
  2⤵
  PID:4368
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
    3⤵
    PID:2696
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
  2⤵
  PID:3552
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
    3⤵
    PID:844
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000001.regtrans-ms
  2⤵
  PID:3684
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000001.regtrans-ms
    3⤵
    PID:4888
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000001.regtrans-ms
  2⤵
  PID:1412
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000001.regtrans-ms
    3⤵
    PID:2948
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000001.regtrans-ms
  2⤵
  PID:180
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000001.regtrans-ms
    3⤵
    PID:1844
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000001.regtrans-ms
  2⤵
  PID:1944
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000001.regtrans-ms
    3⤵
    PID:1364
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000002.regtrans-ms
  2⤵
  PID:3228
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000002.regtrans-ms
    3⤵
    PID:1076
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000002.regtrans-ms
  2⤵
  PID:4292
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000002.regtrans-ms
    3⤵
    PID:4460
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000002.regtrans-ms
  2⤵
  PID:4760
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000002.regtrans-ms
    3⤵
    PID:628
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000002.regtrans-ms
  2⤵
  PID:2176
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat{3484f5f4-84c7-11ef-b9a4-46b98598d6ff}.TMContainer00000000000000000002.regtrans-ms
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpn.dll"
  2⤵
  PID:736
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpn.dll"
    3⤵
    PID:448
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpn.dll"
  2⤵
  PID:4896
- - C:\Windows\system32\takeown.exe
    TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpn.dll"
    3⤵
    PID:3808
- C:\Windows\system32\cmd.exe
  cmd /C TAKEOWN /F "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpn.dll"
  2⤵
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads