Analysis
-
max time kernel
129s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 15:20
Static task
static1
General
-
Target
2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
-
Size
3.2MB
-
MD5
69599f6b37fb75a88be6121cbdf8cfe8
-
SHA1
c6538bd057e6de5059aaff542d053fbaf0b06671
-
SHA256
9b6605e129266a2c4d0c8658dd5d1861a910f7610ba4c5aa33c78644b7875e61
-
SHA512
4c7593dd79ea58b43c91de74d4e1272de8684915f5b9a61973d6e20b6dfbd9993d7e67aabfd03bb5c1118da86b4a5d5134e55f594e544c1522d97569aaa264ce
-
SSDEEP
49152:yCwsbCANnKXferL7Vwe/Gg0P+WhZ53LBfL+5DGC:Vws2ANnKXOaeOgmhZ1LBfsDd
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2324-20-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2324-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2324-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1624-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1624-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2868-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2868-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2868-39-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2868-42-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2868-46-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\240641968.txt family_gh0strat behavioral1/memory/2324-20-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2324-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2324-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1624-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1624-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2868-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2868-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2868-39-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2868-42-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2868-46-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatfor.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
R.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240641968.txt" R.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatfor.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe -
Executes dropped EXE 64 IoCs
Processes:
R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeRemote Data.exeR.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeN.exeR.exeTXPlatfor.exeR.exeN.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeN.exeR.exeTXPlatfor.exeR.exeR.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeTXPlatfor.exeN.exeN.exeN.exeR.exeN.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeR.exeTXPlatfor.exeR.exeR.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeN.exeN.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeN.exeN.exeTXPlatfor.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeR.exepid process 3068 R.exe 2324 N.exe 1624 TXPlatfor.exe 2868 TXPlatfor.exe 3840 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 588 Remote Data.exe 5396 R.exe 5440 N.exe 5484 TXPlatfor.exe 5532 TXPlatfor.exe 5552 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2112 R.exe 4876 N.exe 5828 TXPlatfor.exe 5864 TXPlatfor.exe 1380 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2936 R.exe 1388 N.exe 4516 TXPlatfor.exe 6064 TXPlatfor.exe 1732 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 1340 R.exe 1992 N.exe 3088 TXPlatfor.exe 5148 TXPlatfor.exe 5172 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5508 R.exe 5276 N.exe 5548 R.exe 5228 TXPlatfor.exe 5596 R.exe 3128 N.exe 3960 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 3712 N.exe 2940 R.exe 1568 TXPlatfor.exe 1900 R.exe 5808 R.exe 5032 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 4356 R.exe 5768 TXPlatfor.exe 5748 N.exe 5968 N.exe 5972 N.exe 6020 R.exe 4544 N.exe 4808 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2384 R.exe 1388 R.exe 2788 TXPlatfor.exe 3432 R.exe 2584 R.exe 3632 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5284 R.exe 5144 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5148 N.exe 5280 N.exe 4100 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5536 N.exe 5400 N.exe 5232 TXPlatfor.exe 5388 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 3984 R.exe 5512 R.exe -
Loads dropped DLL 3 IoCs
Processes:
R.exesvchost.exeRemote Data.exepid process 3068 R.exe 324 svchost.exe 588 Remote Data.exe -
Processes:
resource yara_rule behavioral1/memory/2324-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2324-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2324-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2324-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1624-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1624-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1624-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2868-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2868-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2868-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2868-39-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2868-42-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2868-46-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 64 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exedescription ioc process File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe File opened for modification \??\PhysicalDrive0 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe -
Drops file in System32 directory 6 IoCs
Processes:
R.exesvchost.exeN.exedescription ioc process File created C:\Windows\SysWOW64\240641968.txt R.exe File opened for modification C:\Windows\SysWOW64\ini.ini R.exe File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
Processes:
taskmgr.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings taskmgr.exe -
Runs ping.exe 1 TTPs 25 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 5428 PING.EXE 4356 PING.EXE 2584 PING.EXE 6136 PING.EXE 5152 PING.EXE 7712 PING.EXE 636 PING.EXE 2032 PING.EXE 1212 PING.EXE 6868 PING.EXE 5572 PING.EXE 7600 PING.EXE 3008 PING.EXE 5848 PING.EXE 4328 PING.EXE 3784 PING.EXE 4744 PING.EXE 6908 PING.EXE 8120 PING.EXE 6096 PING.EXE 5196 PING.EXE 748 PING.EXE 5200 PING.EXE 7684 PING.EXE 5616 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exetaskmgr.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exepid process 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2384 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2384 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2476 taskmgr.exe 2476 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 2476 taskmgr.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatfor.exepid process 2868 TXPlatfor.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
N.exeTXPlatfor.exetaskmgr.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exeN.exedescription pid process Token: SeIncBasePriorityPrivilege 2324 N.exe Token: SeLoadDriverPrivilege 2868 TXPlatfor.exe Token: SeDebugPrivilege 2476 taskmgr.exe Token: SeSystemProfilePrivilege 2476 taskmgr.exe Token: SeCreateGlobalPrivilege 2476 taskmgr.exe Token: SeIncBasePriorityPrivilege 5440 N.exe Token: 33 2868 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 2868 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 4876 N.exe Token: SeIncBasePriorityPrivilege 1388 N.exe Token: SeIncBasePriorityPrivilege 1992 N.exe Token: SeIncBasePriorityPrivilege 5276 N.exe Token: SeIncBasePriorityPrivilege 3712 N.exe Token: SeIncBasePriorityPrivilege 5148 N.exe Token: SeIncBasePriorityPrivilege 5576 N.exe Token: SeIncBasePriorityPrivilege 5920 N.exe Token: SeIncBasePriorityPrivilege 5488 N.exe Token: SeIncBasePriorityPrivilege 5748 N.exe Token: SeIncBasePriorityPrivilege 5568 N.exe Token: SeIncBasePriorityPrivilege 5980 N.exe Token: SeIncBasePriorityPrivilege 5168 N.exe Token: SeIncBasePriorityPrivilege 2856 N.exe Token: SeIncBasePriorityPrivilege 6520 N.exe Token: SeIncBasePriorityPrivilege 5504 N.exe Token: SeIncBasePriorityPrivilege 6972 N.exe Token: SeIncBasePriorityPrivilege 6584 N.exe Token: SeIncBasePriorityPrivilege 6804 N.exe Token: SeIncBasePriorityPrivilege 8084 N.exe Token: SeIncBasePriorityPrivilege 1780 N.exe Token: SeIncBasePriorityPrivilege 4916 N.exe Token: SeIncBasePriorityPrivilege 464 N.exe Token: 33 2868 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 2868 TXPlatfor.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe 2476 taskmgr.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exeR.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeHD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeR.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exepid process 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5396 R.exe 5552 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2112 R.exe 1380 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2384 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2384 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2384 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2936 R.exe 1732 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 4612 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 4612 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 4612 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 1340 R.exe 5172 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5468 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5468 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5468 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5508 R.exe 5444 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5444 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5444 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5500 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5500 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5500 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5548 R.exe 1324 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5596 R.exe 5580 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5256 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5312 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 1324 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 1324 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 3960 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5312 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5312 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5256 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5580 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5256 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5580 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2940 R.exe 636 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 1900 R.exe 5808 R.exe 1084 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5032 HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 4356 R.exe 2080 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5816 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 636 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 636 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 1084 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 1084 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5828 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 5836 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2080 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe 2080 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeN.exeTXPlatfor.execmd.exesvchost.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeN.exeTXPlatfor.execmd.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeN.exeTXPlatfor.execmd.exe2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeN.exedescription pid process target process PID 4840 wrote to memory of 3068 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 4840 wrote to memory of 3068 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 4840 wrote to memory of 3068 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 4840 wrote to memory of 2324 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 4840 wrote to memory of 2324 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 4840 wrote to memory of 2324 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 2324 wrote to memory of 2428 2324 N.exe cmd.exe PID 2324 wrote to memory of 2428 2324 N.exe cmd.exe PID 2324 wrote to memory of 2428 2324 N.exe cmd.exe PID 1624 wrote to memory of 2868 1624 TXPlatfor.exe TXPlatfor.exe PID 1624 wrote to memory of 2868 1624 TXPlatfor.exe TXPlatfor.exe PID 1624 wrote to memory of 2868 1624 TXPlatfor.exe TXPlatfor.exe PID 4840 wrote to memory of 3840 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe PID 4840 wrote to memory of 3840 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe PID 4840 wrote to memory of 3840 4840 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe PID 2428 wrote to memory of 4744 2428 cmd.exe PING.EXE PID 2428 wrote to memory of 4744 2428 cmd.exe PING.EXE PID 2428 wrote to memory of 4744 2428 cmd.exe PING.EXE PID 324 wrote to memory of 588 324 svchost.exe Remote Data.exe PID 324 wrote to memory of 588 324 svchost.exe Remote Data.exe PID 324 wrote to memory of 588 324 svchost.exe Remote Data.exe PID 5308 wrote to memory of 5396 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 5308 wrote to memory of 5396 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 5308 wrote to memory of 5396 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 5308 wrote to memory of 5440 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 5308 wrote to memory of 5440 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 5308 wrote to memory of 5440 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 5440 wrote to memory of 5524 5440 N.exe cmd.exe PID 5440 wrote to memory of 5524 5440 N.exe cmd.exe PID 5440 wrote to memory of 5524 5440 N.exe cmd.exe PID 5484 wrote to memory of 5532 5484 TXPlatfor.exe TXPlatfor.exe PID 5484 wrote to memory of 5532 5484 TXPlatfor.exe TXPlatfor.exe PID 5484 wrote to memory of 5532 5484 TXPlatfor.exe TXPlatfor.exe PID 5308 wrote to memory of 5552 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe PID 5308 wrote to memory of 5552 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe PID 5308 wrote to memory of 5552 5308 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe PID 5524 wrote to memory of 5616 5524 cmd.exe PING.EXE PID 5524 wrote to memory of 5616 5524 cmd.exe PING.EXE PID 5524 wrote to memory of 5616 5524 cmd.exe PING.EXE PID 1392 wrote to memory of 2112 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 1392 wrote to memory of 2112 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 1392 wrote to memory of 2112 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 1392 wrote to memory of 4876 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 1392 wrote to memory of 4876 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 1392 wrote to memory of 4876 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 4876 wrote to memory of 5868 4876 N.exe cmd.exe PID 4876 wrote to memory of 5868 4876 N.exe cmd.exe PID 4876 wrote to memory of 5868 4876 N.exe cmd.exe PID 5828 wrote to memory of 5864 5828 TXPlatfor.exe TXPlatfor.exe PID 5828 wrote to memory of 5864 5828 TXPlatfor.exe TXPlatfor.exe PID 5828 wrote to memory of 5864 5828 TXPlatfor.exe TXPlatfor.exe PID 1392 wrote to memory of 1380 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe PID 1392 wrote to memory of 1380 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe PID 1392 wrote to memory of 1380 1392 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe PID 5868 wrote to memory of 2032 5868 cmd.exe PING.EXE PID 5868 wrote to memory of 2032 5868 cmd.exe PING.EXE PID 5868 wrote to memory of 2032 5868 cmd.exe PING.EXE PID 2384 wrote to memory of 2936 2384 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 2384 wrote to memory of 2936 2384 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 2384 wrote to memory of 2936 2384 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe R.exe PID 2384 wrote to memory of 1388 2384 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 2384 wrote to memory of 1388 2384 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 2384 wrote to memory of 1388 2384 2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe N.exe PID 1388 wrote to memory of 6004 1388 N.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\AppData\Local\Temp\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240641968.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1404,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:81⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeC:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe2⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240508121838_002_dotnet_host_8.0.2_win_x64.msi.log1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Thunder Network\DownloadLib\pub_store.datFilesize
121B
MD5dfcde250a5fad8f9a7a87a975f053291
SHA13e5fe4a19a95fffe1764d4b22f6ab52bf181efd2
SHA25672ec8639bacaf659e0f390de0794ce9e383f71689b9d25d8c1c5b024b644b0ea
SHA512e5466b3a722c8b9309f390536364202d26708017d86ad23f8676c069a63f624c5d9fe6f8f4b04bd5438e6e02d64178691cfe24da520c7f5cfb783fe40d6bf8d0
-
C:\Users\Admin\AppData\Local\Temp\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exeFilesize
577KB
MD5a2140682b6a8c862642093955a87b3ec
SHA1f03679bd04bad2c8d58508ad05ebb2caf2fadf76
SHA2563e6d6b2c94191c42a44cc41e7cd05d00600496265c1215925d0e28e0d0ecd6d1
SHA512a85f0ca63c111328d6eb8166924b9583f5b7b09f018e96bdefaf5b725e0437a99ab4d0d70092e958a1f2a1c64920d232264160e52195ec3f4970c49515664a0a
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
2.6MB
MD5274fe01eb0f4cd402c3cfdeda4b30715
SHA172db93e86caaadf2f28e5265ebfbc2ea6ba9e705
SHA256843743adaef60d2f490d2702487f7687ffa36524d11ad89feed31bbddfd21d40
SHA5126d71d57566f436c6e1242421070bca8c62ba95a7ccfc73ae5efef54f93482b3e3b742bda361b7c713a5e5158f11310401341bd1ddd4f011ba33f77c5e9543798
-
C:\Users\Admin\AppData\Local\Temp\N.exeFilesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
C:\Users\Admin\AppData\Local\Temp\R.exeFilesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
C:\Windows\SysWOW64\240641968.txtFilesize
899KB
MD5f354a98b0752d44a76708d89bae7be7d
SHA12b7e01884a812e40c91a25451817de809f01e6a2
SHA2563fd17d0f596e4f07d48423106591dff6494d89b7660548f1212b2c77df0a136e
SHA512b9ee402b468264ab6eff60d7224b712a68f070dd983bc314357951ad70ec60ac2008246db290d6cbc9fdc7acf2d9b4e8938876aa6a2d78041b12578c9e7cd5b0
-
C:\Windows\SysWOW64\Remote Data.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/1624-26-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1624-28-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1624-29-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2324-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2324-21-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2324-19-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2324-20-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2476-62-0x000002693C040000-0x000002693C041000-memory.dmpFilesize
4KB
-
memory/2476-61-0x000002693C040000-0x000002693C041000-memory.dmpFilesize
4KB
-
memory/2476-58-0x000002693C040000-0x000002693C041000-memory.dmpFilesize
4KB
-
memory/2476-57-0x000002693C040000-0x000002693C041000-memory.dmpFilesize
4KB
-
memory/2476-53-0x000002693C040000-0x000002693C041000-memory.dmpFilesize
4KB
-
memory/2476-52-0x000002693C040000-0x000002693C041000-memory.dmpFilesize
4KB
-
memory/2476-51-0x000002693C040000-0x000002693C041000-memory.dmpFilesize
4KB
-
memory/2476-60-0x000002693C040000-0x000002693C041000-memory.dmpFilesize
4KB
-
memory/2476-63-0x000002693C040000-0x000002693C041000-memory.dmpFilesize
4KB
-
memory/2476-59-0x000002693C040000-0x000002693C041000-memory.dmpFilesize
4KB
-
memory/2868-38-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2868-42-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2868-39-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2868-46-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2868-37-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2868-35-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4840-97-0x0000000000400000-0x00000000006BD000-memory.dmpFilesize
2.7MB
-
memory/4840-137-0x0000000000400000-0x00000000006BD000-memory.dmpFilesize
2.7MB