Resubmissions

30-05-2024 15:20

240530-sq7vlacg41 10

29-05-2024 04:50

240529-fgnzxaba2x 10

Analysis

  • max time kernel
    129s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 15:20

General

  • Target

    2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe

  • Size

    3.2MB

  • MD5

    69599f6b37fb75a88be6121cbdf8cfe8

  • SHA1

    c6538bd057e6de5059aaff542d053fbaf0b06671

  • SHA256

    9b6605e129266a2c4d0c8658dd5d1861a910f7610ba4c5aa33c78644b7875e61

  • SHA512

    4c7593dd79ea58b43c91de74d4e1272de8684915f5b9a61973d6e20b6dfbd9993d7e67aabfd03bb5c1118da86b4a5d5134e55f594e544c1522d97569aaa264ce

  • SSDEEP

    49152:yCwsbCANnKXferL7Vwe/Gg0P+WhZ53LBfL+5DGC:Vws2ANnKXOaeOgmhZ1LBfsDd

Malware Config

Signatures

  • Detect PurpleFox Rootkit 10 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 11 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Drops file in Drivers directory 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 64 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Users\Admin\AppData\Local\Temp\R.exe
      C:\Users\Admin\AppData\Local\Temp\\R.exe
      2⤵
      • Sets DLL path for service in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      PID:3068
    • C:\Users\Admin\AppData\Local\Temp\N.exe
      C:\Users\Admin\AppData\Local\Temp\\N.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2428
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:4744
    • C:\Users\Admin\AppData\Local\Temp\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
      C:\Users\Admin\AppData\Local\Temp\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      PID:3840
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
    1⤵
      PID:5036
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:324
      • C:\Windows\SysWOW64\Remote Data.exe
        "C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240641968.txt",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:588
    • C:\Windows\SysWOW64\TXPlatfor.exe
      C:\Windows\SysWOW64\TXPlatfor.exe -auto
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\SysWOW64\TXPlatfor.exe
        C:\Windows\SysWOW64\TXPlatfor.exe -acsi
        2⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Executes dropped EXE
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:2868
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1404,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
      1⤵
        PID:3328
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /7
        1⤵
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2476
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:6024
        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
          1⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5308
          • C:\Users\Admin\AppData\Local\Temp\R.exe
            C:\Users\Admin\AppData\Local\Temp\\R.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:5396
          • C:\Users\Admin\AppData\Local\Temp\N.exe
            C:\Users\Admin\AppData\Local\Temp\\N.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5440
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5524
              • C:\Windows\SysWOW64\PING.EXE
                ping -n 2 127.0.0.1
                4⤵
                • Runs ping.exe
                PID:5616
          • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
            C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:5552
        • C:\Windows\SysWOW64\TXPlatfor.exe
          C:\Windows\SysWOW64\TXPlatfor.exe -auto
          1⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5484
          • C:\Windows\SysWOW64\TXPlatfor.exe
            C:\Windows\SysWOW64\TXPlatfor.exe -acsi
            2⤵
            • Executes dropped EXE
            PID:5532
        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
          1⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1392
          • C:\Users\Admin\AppData\Local\Temp\R.exe
            C:\Users\Admin\AppData\Local\Temp\\R.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2112
          • C:\Users\Admin\AppData\Local\Temp\N.exe
            C:\Users\Admin\AppData\Local\Temp\\N.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4876
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5868
              • C:\Windows\SysWOW64\PING.EXE
                ping -n 2 127.0.0.1
                4⤵
                • Runs ping.exe
                PID:2032
          • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
            C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
            2⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetWindowsHookEx
            PID:1380
        • C:\Windows\SysWOW64\TXPlatfor.exe
          C:\Windows\SysWOW64\TXPlatfor.exe -auto
          1⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5828
          • C:\Windows\SysWOW64\TXPlatfor.exe
            C:\Windows\SysWOW64\TXPlatfor.exe -acsi
            2⤵
            • Executes dropped EXE
            PID:5864
        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
          1⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2384
          • C:\Users\Admin\AppData\Local\Temp\R.exe
            C:\Users\Admin\AppData\Local\Temp\\R.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2936
          • C:\Users\Admin\AppData\Local\Temp\N.exe
            C:\Users\Admin\AppData\Local\Temp\\N.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1388
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
              3⤵
                PID:6004
                • C:\Windows\SysWOW64\PING.EXE
                  ping -n 2 127.0.0.1
                  4⤵
                  • Runs ping.exe
                  PID:2584
            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
              2⤵
              • Executes dropped EXE
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetWindowsHookEx
              PID:1732
          • C:\Windows\SysWOW64\TXPlatfor.exe
            C:\Windows\SysWOW64\TXPlatfor.exe -auto
            1⤵
            • Executes dropped EXE
            PID:4516
            • C:\Windows\SysWOW64\TXPlatfor.exe
              C:\Windows\SysWOW64\TXPlatfor.exe -acsi
              2⤵
              • Executes dropped EXE
              PID:6064
          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:4612
            • C:\Users\Admin\AppData\Local\Temp\R.exe
              C:\Users\Admin\AppData\Local\Temp\\R.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1340
            • C:\Users\Admin\AppData\Local\Temp\N.exe
              C:\Users\Admin\AppData\Local\Temp\\N.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1992
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                3⤵
                  PID:4488
                  • C:\Windows\SysWOW64\PING.EXE
                    ping -n 2 127.0.0.1
                    4⤵
                    • Runs ping.exe
                    PID:5428
              • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:5172
            • C:\Windows\SysWOW64\TXPlatfor.exe
              C:\Windows\SysWOW64\TXPlatfor.exe -auto
              1⤵
              • Executes dropped EXE
              PID:3088
              • C:\Windows\SysWOW64\TXPlatfor.exe
                C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                2⤵
                • Executes dropped EXE
                PID:5148
            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:5468
              • C:\Users\Admin\AppData\Local\Temp\R.exe
                C:\Users\Admin\AppData\Local\Temp\\R.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:5508
              • C:\Users\Admin\AppData\Local\Temp\N.exe
                C:\Users\Admin\AppData\Local\Temp\\N.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5276
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                  3⤵
                    PID:3024
                    • C:\Windows\SysWOW64\PING.EXE
                      ping -n 2 127.0.0.1
                      4⤵
                      • Runs ping.exe
                      PID:4328
                • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                  C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3960
              • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:5444
                • C:\Users\Admin\AppData\Local\Temp\R.exe
                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5548
                • C:\Users\Admin\AppData\Local\Temp\N.exe
                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                  2⤵
                  • Executes dropped EXE
                  PID:3128
                • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                  C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                  2⤵
                  • Executes dropped EXE
                  • Writes to the Master Boot Record (MBR)
                  • Suspicious use of SetWindowsHookEx
                  PID:5032
              • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:5500
                • C:\Users\Admin\AppData\Local\Temp\R.exe
                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5596
                • C:\Users\Admin\AppData\Local\Temp\N.exe
                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3712
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                    3⤵
                      PID:1012
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        4⤵
                          PID:6020
                        • C:\Windows\SysWOW64\PING.EXE
                          ping -n 2 127.0.0.1
                          4⤵
                          • Runs ping.exe
                          PID:5196
                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      2⤵
                      • Executes dropped EXE
                      PID:4808
                  • C:\Windows\SysWOW64\TXPlatfor.exe
                    C:\Windows\SysWOW64\TXPlatfor.exe -auto
                    1⤵
                    • Executes dropped EXE
                    PID:5228
                    • C:\Windows\SysWOW64\TXPlatfor.exe
                      C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                      2⤵
                      • Executes dropped EXE
                      PID:1568
                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:5256
                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4356
                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                      2⤵
                      • Executes dropped EXE
                      PID:4544
                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      2⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      PID:5388
                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:1324
                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2940
                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                      2⤵
                      • Executes dropped EXE
                      PID:5748
                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      2⤵
                      • Executes dropped EXE
                      PID:3632
                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:5580
                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5808
                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                      2⤵
                      • Executes dropped EXE
                      PID:5972
                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      2⤵
                      • Executes dropped EXE
                      PID:5144
                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:5312
                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1900
                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                      2⤵
                      • Executes dropped EXE
                      PID:5968
                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      2⤵
                      • Executes dropped EXE
                      PID:4100
                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:636
                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                      2⤵
                      • Executes dropped EXE
                      PID:6020
                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                      2⤵
                      • Executes dropped EXE
                      PID:5280
                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      2⤵
                      • Writes to the Master Boot Record (MBR)
                      PID:5864
                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:2080
                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                      2⤵
                      • Executes dropped EXE
                      PID:2584
                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                      2⤵
                      • Executes dropped EXE
                      PID:5400
                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                      2⤵
                      • Writes to the Master Boot Record (MBR)
                      PID:6048
                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:1084
                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                      2⤵
                      • Executes dropped EXE
                      PID:1388
                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5148
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                        3⤵
                          PID:5692
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            4⤵
                              PID:5972
                            • C:\Windows\SysWOW64\PING.EXE
                              ping -n 2 127.0.0.1
                              4⤵
                              • Runs ping.exe
                              PID:6136
                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                          2⤵
                          • Writes to the Master Boot Record (MBR)
                          PID:1204
                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:5836
                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                          2⤵
                          • Executes dropped EXE
                          PID:2384
                        • C:\Users\Admin\AppData\Local\Temp\N.exe
                          C:\Users\Admin\AppData\Local\Temp\\N.exe
                          2⤵
                          • Executes dropped EXE
                          PID:5536
                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                          2⤵
                          • Writes to the Master Boot Record (MBR)
                          PID:2832
                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:5816
                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                          2⤵
                          • Executes dropped EXE
                          PID:5284
                        • C:\Users\Admin\AppData\Local\Temp\N.exe
                          C:\Users\Admin\AppData\Local\Temp\\N.exe
                          2⤵
                            PID:1268
                          • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                            C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                            2⤵
                            • Writes to the Master Boot Record (MBR)
                            PID:5768
                        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                          1⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:5828
                          • C:\Users\Admin\AppData\Local\Temp\R.exe
                            C:\Users\Admin\AppData\Local\Temp\\R.exe
                            2⤵
                            • Executes dropped EXE
                            PID:3432
                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                            2⤵
                              PID:5092
                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                              2⤵
                                PID:1700
                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                              1⤵
                                PID:2108
                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                  2⤵
                                    PID:3768
                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                    2⤵
                                      PID:5564
                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                      2⤵
                                      • Writes to the Master Boot Record (MBR)
                                      PID:3236
                                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                    1⤵
                                      PID:5884
                                      • C:\Users\Admin\AppData\Local\Temp\R.exe
                                        C:\Users\Admin\AppData\Local\Temp\\R.exe
                                        2⤵
                                        • Executes dropped EXE
                                        PID:3984
                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                        2⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5576
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                          3⤵
                                            PID:1324
                                            • C:\Windows\SysWOW64\PING.EXE
                                              ping -n 2 127.0.0.1
                                              4⤵
                                              • Runs ping.exe
                                              PID:4356
                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                          2⤵
                                          • Writes to the Master Boot Record (MBR)
                                          PID:6112
                                      • C:\Windows\SysWOW64\TXPlatfor.exe
                                        C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                        1⤵
                                        • Executes dropped EXE
                                        PID:5768
                                        • C:\Windows\SysWOW64\TXPlatfor.exe
                                          C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                          2⤵
                                          • Executes dropped EXE
                                          PID:2788
                                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                        1⤵
                                          PID:2032
                                          • C:\Users\Admin\AppData\Local\Temp\R.exe
                                            C:\Users\Admin\AppData\Local\Temp\\R.exe
                                            2⤵
                                            • Executes dropped EXE
                                            PID:5512
                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                            2⤵
                                              PID:5604
                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                              2⤵
                                              • Writes to the Master Boot Record (MBR)
                                              PID:5400
                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                            1⤵
                                              PID:3060
                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                2⤵
                                                  PID:5804
                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                  2⤵
                                                    PID:4968
                                                  • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                    C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                    2⤵
                                                      PID:5852
                                                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                    1⤵
                                                      PID:6024
                                                      • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                        C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                        2⤵
                                                          PID:5316
                                                        • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                          C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                          2⤵
                                                            PID:1512
                                                          • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                            C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                            2⤵
                                                            • Writes to the Master Boot Record (MBR)
                                                            PID:3656
                                                        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                          1⤵
                                                            PID:1000
                                                            • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                              C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                              2⤵
                                                                PID:884
                                                              • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                2⤵
                                                                  PID:4612
                                                                • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                  C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                  2⤵
                                                                    PID:4944
                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                  1⤵
                                                                    PID:848
                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                      2⤵
                                                                        PID:5216
                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                        2⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5488
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                          3⤵
                                                                            PID:5212
                                                                            • C:\Windows\System32\Conhost.exe
                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                              4⤵
                                                                                PID:884
                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                ping -n 2 127.0.0.1
                                                                                4⤵
                                                                                • Runs ping.exe
                                                                                PID:1212
                                                                          • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                            C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                            2⤵
                                                                            • Writes to the Master Boot Record (MBR)
                                                                            PID:2184
                                                                        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                          1⤵
                                                                            PID:3640
                                                                            • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                              2⤵
                                                                                PID:5464
                                                                              • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                2⤵
                                                                                  PID:2324
                                                                                • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                  C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                  2⤵
                                                                                  • Writes to the Master Boot Record (MBR)
                                                                                  PID:2584
                                                                              • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                1⤵
                                                                                  PID:2996
                                                                                  • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                    2⤵
                                                                                      PID:1900
                                                                                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                      2⤵
                                                                                        PID:2604
                                                                                      • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                        C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                        2⤵
                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                        PID:5912
                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                      1⤵
                                                                                        PID:2016
                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                          2⤵
                                                                                            PID:5916
                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                            2⤵
                                                                                              PID:1656
                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                              2⤵
                                                                                                PID:5804
                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                              1⤵
                                                                                                PID:6132
                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                  2⤵
                                                                                                    PID:5856
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                    2⤵
                                                                                                      PID:6004
                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                      2⤵
                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                      PID:3984
                                                                                                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                    1⤵
                                                                                                      PID:5568
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                        2⤵
                                                                                                          PID:3236
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                          2⤵
                                                                                                            PID:5496
                                                                                                          • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                            C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                            2⤵
                                                                                                              PID:5092
                                                                                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                            1⤵
                                                                                                              PID:4916
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                2⤵
                                                                                                                  PID:5840
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                  2⤵
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:5920
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                    3⤵
                                                                                                                      PID:6036
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        4⤵
                                                                                                                          PID:3960
                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                          ping -n 2 127.0.0.1
                                                                                                                          4⤵
                                                                                                                          • Runs ping.exe
                                                                                                                          PID:748
                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                      2⤵
                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                      PID:5748
                                                                                                                  • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                    C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:5232
                                                                                                                    • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                      C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                      2⤵
                                                                                                                        PID:1504
                                                                                                                    • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                      C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                      1⤵
                                                                                                                        PID:5032
                                                                                                                        • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                          C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                          2⤵
                                                                                                                            PID:5384
                                                                                                                        • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                          C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                          1⤵
                                                                                                                            PID:5280
                                                                                                                            • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                              C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                              2⤵
                                                                                                                                PID:5244
                                                                                                                            • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                              C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                              1⤵
                                                                                                                                PID:5540
                                                                                                                                • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                  2⤵
                                                                                                                                    PID:464
                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                  1⤵
                                                                                                                                    PID:5844
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:5960
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                        2⤵
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:5748
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                          3⤵
                                                                                                                                            PID:3176
                                                                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                              ping -n 2 127.0.0.1
                                                                                                                                              4⤵
                                                                                                                                              • Runs ping.exe
                                                                                                                                              PID:5200
                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:2004
                                                                                                                                        • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                          C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                          1⤵
                                                                                                                                            PID:2020
                                                                                                                                            • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                              C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                              2⤵
                                                                                                                                                PID:4916
                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                              1⤵
                                                                                                                                                PID:2108
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1700
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                    2⤵
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:5568
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2184
                                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                          ping -n 2 127.0.0.1
                                                                                                                                                          4⤵
                                                                                                                                                          • Runs ping.exe
                                                                                                                                                          PID:6096
                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                                                      PID:2080
                                                                                                                                                  • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                    C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1652
                                                                                                                                                      • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                        C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5448
                                                                                                                                                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:5240
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5308
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                              2⤵
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:5980
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:6004
                                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                    ping -n 2 127.0.0.1
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                    PID:8120
                                                                                                                                                              • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                PID:2092
                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:116
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1108
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1480
                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1060
                                                                                                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5564
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5840
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:5168
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5172
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:5652
                                                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                    ping -n 2 127.0.0.1
                                                                                                                                                                                    4⤵
                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                    PID:5152
                                                                                                                                                                              • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3632
                                                                                                                                                                              • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:3488
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5484
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2284
                                                                                                                                                                                      • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                        C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                        PID:6168
                                                                                                                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:5400
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1992
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:5092
                                                                                                                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:6684
                                                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4356
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:5592
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:5508
                                                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:6180
                                                                                                                                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:6112
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:2856
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5444
                                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                  ping -n 2 127.0.0.1
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                  PID:6908
                                                                                                                                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:6220
                                                                                                                                                                                                            • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:3044
                                                                                                                                                                                                                • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:6068
                                                                                                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:6124
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2400
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4916
                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:6160
                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:5204
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4940
                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                  C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:7084
                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:4344
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:4184
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:4676
                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:6432
                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:5456
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:5244
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:5260
                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:6868
                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:5272
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:404
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:6396
                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4944
                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:3060
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:3652
                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                  PID:7112
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:1904
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:5612
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:6940
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:5536
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:7140
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:7024
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:5992
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:6464
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:7120
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                        PID:6940
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:6116
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:6284
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:6968
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                              PID:5652
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:4612
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:6668
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                    PID:6384
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:6060
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:5240
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:5280
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:6276
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:6256
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:5924
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:5492
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:6260
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:7132
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:6624
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:5748
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:6252
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:6620
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:5904
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:6720
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:6344
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                      PID:5208
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:5856
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:5212
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                          PID:6520
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:1588
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:7132
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                  ping -n 2 127.0.0.1
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                  PID:7684
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                              PID:6504
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:5560
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6236
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:7024
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6436
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1700
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6744
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5752
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                            PID:7828
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1856
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6736
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6468
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                  PID:8064
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5952
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6268
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6636
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5452
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6788
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6260
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                              PID:6720
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1780
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6728
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6276
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                    PID:5868
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5436
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:6852
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5260
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                          PID:5960
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2940
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6708
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                              PID:5504
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6528
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                    ping -n 2 127.0.0.1
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6868
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                PID:6808
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6812
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7948
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6796
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                              PID:7632
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6752
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7324
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6760
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7072
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7256
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8088
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6580
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6808
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:400
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8112
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7076
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7356
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping -n 2 127.0.0.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping -n 2 127.0.0.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping -n 2 127.0.0.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping -n 2 127.0.0.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping -n 2 127.0.0.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping -n 2 127.0.0.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping -n 2 127.0.0.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Desktop\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\TXPlatfor.exe -auto
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\TXPlatfor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240508121838_002_dotnet_host_8.0.2_win_x64.msi.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1756

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Pre-OS Boot

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1542

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Bootkit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1542.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Pre-OS Boot

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1542

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Bootkit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1542.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1018

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Thunder Network\DownloadLib\pub_store.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      121B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dfcde250a5fad8f9a7a87a975f053291

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3e5fe4a19a95fffe1764d4b22f6ab52bf181efd2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      72ec8639bacaf659e0f390de0794ce9e383f71689b9d25d8c1c5b024b644b0ea

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      e5466b3a722c8b9309f390536364202d26708017d86ad23f8676c069a63f624c5d9fe6f8f4b04bd5438e6e02d64178691cfe24da520c7f5cfb783fe40d6bf8d0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\HD_2024-05-29_69599f6b37fb75a88be6121cbdf8cfe8_icedid.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      577KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      a2140682b6a8c862642093955a87b3ec

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      f03679bd04bad2c8d58508ad05ebb2caf2fadf76

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3e6d6b2c94191c42a44cc41e7cd05d00600496265c1215925d0e28e0d0ecd6d1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      a85f0ca63c111328d6eb8166924b9583f5b7b09f018e96bdefaf5b725e0437a99ab4d0d70092e958a1f2a1c64920d232264160e52195ec3f4970c49515664a0a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\HD_X.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      274fe01eb0f4cd402c3cfdeda4b30715

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      72db93e86caaadf2f28e5265ebfbc2ea6ba9e705

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      843743adaef60d2f490d2702487f7687ffa36524d11ad89feed31bbddfd21d40

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6d71d57566f436c6e1242421070bca8c62ba95a7ccfc73ae5efef54f93482b3e3b742bda361b7c713a5e5158f11310401341bd1ddd4f011ba33f77c5e9543798

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      377KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4a36a48e58829c22381572b2040b6fe0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      f09d30e44ff7e3f20a5de307720f3ad148c6143b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      941KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8dc3adf1c490211971c1e2325f1424d2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\240641968.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      899KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      f354a98b0752d44a76708d89bae7be7d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2b7e01884a812e40c91a25451817de809f01e6a2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3fd17d0f596e4f07d48423106591dff6494d89b7660548f1212b2c77df0a136e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      b9ee402b468264ab6eff60d7224b712a68f070dd983bc314357951ad70ec60ac2008246db290d6cbc9fdc7acf2d9b4e8938876aa6a2d78041b12578c9e7cd5b0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Remote Data.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      60KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      889b99c52a60dd49227c5e485a016679

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8fa889e456aa646a4d0a4349977430ce5fa5e2d7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1624-26-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1624-28-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1624-29-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2324-17-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2324-21-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2324-19-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2324-20-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2476-62-0x000002693C040000-0x000002693C041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2476-61-0x000002693C040000-0x000002693C041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2476-58-0x000002693C040000-0x000002693C041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2476-57-0x000002693C040000-0x000002693C041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2476-53-0x000002693C040000-0x000002693C041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2476-52-0x000002693C040000-0x000002693C041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2476-51-0x000002693C040000-0x000002693C041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2476-60-0x000002693C040000-0x000002693C041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2476-63-0x000002693C040000-0x000002693C041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2476-59-0x000002693C040000-0x000002693C041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2868-38-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2868-42-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2868-39-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2868-46-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2868-37-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2868-35-0x0000000010000000-0x00000000101B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4840-97-0x0000000000400000-0x00000000006BD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4840-137-0x0000000000400000-0x00000000006BD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2.7MB