Detected lateral movement from internal host 192.168.1.45 using compromised credentials to access additional network resources. The attacker is using tools to locate and prepare systems for encryption.