aca3b17ad65e58e4f813c511650dfdfbf61d67a634c49bef0c885eb84126da8b

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe
Size 10.2MB
Sample261029-2phzhstvdw
SHA256 aca3b17ad65e58e4f813c511650dfdfbf61d67a634c49bef0c885eb84126da8b
MD5 9b81d86cf723654af497ba687edcf7b0
SHA1 b1a276e7a4836cd4a3b965f0d2df784a76573437
SHA512 6640c59faf845d21477440755961d44c9af227a8a240cd338b9d46482db648c3e0124343475c4e001d113b634fbe5874df68edf1806fea802c74332db21ddc99
SSDEEP 98304:m6Hir8DdYkutMue/JpoG2Fet5koKwKEAz6oy7dtPbCWAsfZuUBborQROr:m6y85Vukpo/FetGo5KEDp5ykZ9BMrME
TLSH
T170B67D433693EC47964B3856C06FEC711D2C9CAA088EEA7AC43DE2DF9D9A1532C27571
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\system32 = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\windowss = "0"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\svchost.exe = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming = "0"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	svchost.exe

Detects executables referencing many IR and analysis tools 13 IoCs

resource	yara_rule
behavioral1/memory/736-12-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/736-20-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/736-19-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/736-18-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/736-22-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x00070000000244f1-32.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/736-30-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/736-23-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/1184-91-0x00007FFFCE9C0000-0x00007FFFCE9E2000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/1184-143-0x00007FFFCE9C0000-0x00007FFFCE9E2000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/1184-190-0x00007FFFCE9C0000-0x00007FFFCE9E2000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/1184-208-0x00007FFFCE9C0000-0x00007FFFCE9E2000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/1184-224-0x00007FFFCE9C0000-0x00007FFFCE9E2000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Executes dropped EXE 64 IoCs

pid	Process
1184	Process not Found
4708	windows.exe
3452	dllhost.exe
624	SearchProtocolHost.exe
3852	SearchFilterHost.exe
2592	WmiPrvSE.exe
3012	dllhost.exe
1716	SearchProtocolHost.exe
4732	SearchFilterHost.exe
4036	WmiPrvSE.exe
1384	dllhost.exe
2212	SearchProtocolHost.exe
4452	SearchFilterHost.exe
3884	WmiPrvSE.exe
880	dllhost.exe
4796	SearchProtocolHost.exe
4892	SearchFilterHost.exe
824	WmiPrvSE.exe
2648	dllhost.exe
4252	SearchProtocolHost.exe
4652	SearchFilterHost.exe
2964	WmiPrvSE.exe
1084	dllhost.exe
4596	SearchProtocolHost.exe
1704	SearchFilterHost.exe
3548	WmiPrvSE.exe
1708	dllhost.exe
1324	SearchProtocolHost.exe
644	SearchFilterHost.exe
3276	WmiPrvSE.exe
1112	dllhost.exe
4284	SearchProtocolHost.exe
2192	SearchFilterHost.exe
2124	WmiPrvSE.exe
2400	dllhost.exe
3340	SearchProtocolHost.exe
4552	SearchFilterHost.exe
2300	WmiPrvSE.exe
4456	dllhost.exe
4496	SearchProtocolHost.exe
3948	SearchFilterHost.exe
1896	WmiPrvSE.exe
3360	dllhost.exe
3524	SearchProtocolHost.exe
1080	SearchFilterHost.exe
1168	WmiPrvSE.exe
4272	dllhost.exe
3032	SearchProtocolHost.exe
3468	SearchFilterHost.exe
4380	WmiPrvSE.exe
3164	dllhost.exe
2492	SearchProtocolHost.exe
2596	SearchFilterHost.exe
1764	WmiPrvSE.exe
2268	dllhost.exe
316	SearchProtocolHost.exe
1504	SearchFilterHost.exe
2996	WmiPrvSE.exe
2628	dllhost.exe
2096	SearchProtocolHost.exe
560	SearchFilterHost.exe
4132	WmiPrvSE.exe
3112	dllhost.exe
1716	SearchProtocolHost.exe

Loads dropped DLL 64 IoCs

pid	Process
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	Process not Found

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
736	svchost.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 896	4412	2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe	85
PID 896 set thread context of 736	896	svchost.exe	86
PID 736 set thread context of 1752	736	svchost.exe	87
PID 736 set thread context of 2464	736	svchost.exe	88
PID 736 set thread context of 3432	736	svchost.exe	90
PID 736 set thread context of 1104	736	svchost.exe	93
PID 736 set thread context of 3452	736	svchost.exe	94
PID 736 set thread context of 624	736	svchost.exe	97
PID 736 set thread context of 3852	736	svchost.exe	98
PID 736 set thread context of 2592	736	svchost.exe	99
PID 736 set thread context of 3012	736	svchost.exe	100
PID 736 set thread context of 1716	736	svchost.exe	102
PID 736 set thread context of 4732	736	svchost.exe	103
PID 736 set thread context of 4036	736	svchost.exe	104
PID 736 set thread context of 1384	736	svchost.exe	105
PID 736 set thread context of 2212	736	svchost.exe	107
PID 736 set thread context of 4452	736	svchost.exe	109
PID 736 set thread context of 3884	736	svchost.exe	110
PID 736 set thread context of 880	736	svchost.exe	111
PID 736 set thread context of 4796	736	svchost.exe	112
PID 736 set thread context of 4892	736	svchost.exe	113
PID 736 set thread context of 824	736	svchost.exe	114
PID 736 set thread context of 2648	736	svchost.exe	115
PID 736 set thread context of 4252	736	svchost.exe	116
PID 736 set thread context of 4652	736	svchost.exe	117
PID 736 set thread context of 2964	736	svchost.exe	118
PID 736 set thread context of 1084	736	svchost.exe	119
PID 736 set thread context of 4596	736	svchost.exe	120
PID 736 set thread context of 1704	736	svchost.exe	121
PID 736 set thread context of 3548	736	svchost.exe	122
PID 736 set thread context of 1708	736	svchost.exe	123
PID 736 set thread context of 1324	736	svchost.exe	124
PID 736 set thread context of 644	736	svchost.exe	125
PID 736 set thread context of 3276	736	svchost.exe	126
PID 736 set thread context of 1112	736	svchost.exe	127
PID 736 set thread context of 4284	736	svchost.exe	129
PID 736 set thread context of 2192	736	svchost.exe	130
PID 736 set thread context of 2124	736	svchost.exe	131
PID 736 set thread context of 2400	736	svchost.exe	132
PID 736 set thread context of 3340	736	svchost.exe	133
PID 736 set thread context of 4552	736	svchost.exe	134
PID 736 set thread context of 2300	736	svchost.exe	135
PID 736 set thread context of 4456	736	svchost.exe	136
PID 736 set thread context of 4496	736	svchost.exe	138
PID 736 set thread context of 3948	736	svchost.exe	139
PID 736 set thread context of 1896	736	svchost.exe	140
PID 736 set thread context of 3360	736	svchost.exe	141
PID 736 set thread context of 3524	736	svchost.exe	142
PID 736 set thread context of 1080	736	svchost.exe	143
PID 736 set thread context of 1168	736	svchost.exe	144
PID 736 set thread context of 4272	736	svchost.exe	145
PID 736 set thread context of 3032	736	svchost.exe	146
PID 736 set thread context of 3468	736	svchost.exe	147
PID 736 set thread context of 4380	736	svchost.exe	148
PID 736 set thread context of 3164	736	svchost.exe	149
PID 736 set thread context of 2492	736	svchost.exe	150
PID 736 set thread context of 2596	736	svchost.exe	151
PID 736 set thread context of 1764	736	svchost.exe	152
PID 736 set thread context of 2268	736	svchost.exe	153
PID 736 set thread context of 316	736	svchost.exe	154
PID 736 set thread context of 1504	736	svchost.exe	155
PID 736 set thread context of 2996	736	svchost.exe	156
PID 736 set thread context of 2628	736	svchost.exe	157
PID 736 set thread context of 2096	736	svchost.exe	158

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1793313954"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 28 Oct 2026 14:27:47 GMT"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={2F2A222C-534E-43BC-9041-DD0F64CC3B3A}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
896	svchost.exe
896	svchost.exe
896	svchost.exe
896	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
1184	Process not Found
1184	Process not Found
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
1184	Process not Found
1184	Process not Found
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
1184	Process not Found
1184	Process not Found
736	svchost.exe
736	svchost.exe
736	svchost.exe
1184	Process not Found
1184	Process not Found
736	svchost.exe
736	svchost.exe
736	svchost.exe
1184	Process not Found
1184	Process not Found
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
1184	Process not Found
1184	Process not Found
736	svchost.exe
736	svchost.exe
1184	Process not Found
1184	Process not Found
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
1184	Process not Found
1184	Process not Found
736	svchost.exe
736	svchost.exe
1184	Process not Found
1184	Process not Found
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
736	svchost.exe
1184	Process not Found
1184	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	896	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe
Token: SeDebugPrivilege	736	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 896	4412	2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe	85
PID 4412 wrote to memory of 896	4412	2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe	85
PID 896 wrote to memory of 736	896	svchost.exe	86
PID 896 wrote to memory of 736	896	svchost.exe	86
PID 736 wrote to memory of 1752	736	svchost.exe	87
PID 736 wrote to memory of 2464	736	svchost.exe	88
PID 736 wrote to memory of 4708	736	svchost.exe	89
PID 736 wrote to memory of 3432	736	svchost.exe	90
PID 736 wrote to memory of 1104	736	svchost.exe	93
PID 736 wrote to memory of 3452	736	svchost.exe	94
PID 736 wrote to memory of 624	736	svchost.exe	97
PID 736 wrote to memory of 3852	736	svchost.exe	98
PID 736 wrote to memory of 2592	736	svchost.exe	99
PID 736 wrote to memory of 3012	736	svchost.exe	100
PID 736 wrote to memory of 1716	736	svchost.exe	102
PID 736 wrote to memory of 4732	736	svchost.exe	103
PID 736 wrote to memory of 4036	736	svchost.exe	104
PID 736 wrote to memory of 1384	736	svchost.exe	105
PID 736 wrote to memory of 2212	736	svchost.exe	107
PID 736 wrote to memory of 4452	736	svchost.exe	109
PID 736 wrote to memory of 3884	736	svchost.exe	110
PID 736 wrote to memory of 880	736	svchost.exe	111
PID 736 wrote to memory of 4796	736	svchost.exe	112
PID 736 wrote to memory of 4892	736	svchost.exe	113
PID 736 wrote to memory of 824	736	svchost.exe	114
PID 736 wrote to memory of 2648	736	svchost.exe	115
PID 736 wrote to memory of 4252	736	svchost.exe	116
PID 736 wrote to memory of 4652	736	svchost.exe	117
PID 736 wrote to memory of 2964	736	svchost.exe	118
PID 736 wrote to memory of 1084	736	svchost.exe	119
PID 736 wrote to memory of 4596	736	svchost.exe	120
PID 736 wrote to memory of 1704	736	svchost.exe	121
PID 736 wrote to memory of 3548	736	svchost.exe	122
PID 736 wrote to memory of 1708	736	svchost.exe	123
PID 736 wrote to memory of 1324	736	svchost.exe	124
PID 736 wrote to memory of 644	736	svchost.exe	125
PID 736 wrote to memory of 3276	736	svchost.exe	126
PID 736 wrote to memory of 1112	736	svchost.exe	127
PID 736 wrote to memory of 4284	736	svchost.exe	129
PID 736 wrote to memory of 2192	736	svchost.exe	130
PID 736 wrote to memory of 2124	736	svchost.exe	131
PID 736 wrote to memory of 2400	736	svchost.exe	132
PID 736 wrote to memory of 3340	736	svchost.exe	133
PID 736 wrote to memory of 4552	736	svchost.exe	134
PID 736 wrote to memory of 2300	736	svchost.exe	135
PID 736 wrote to memory of 4456	736	svchost.exe	136
PID 736 wrote to memory of 4496	736	svchost.exe	138
PID 736 wrote to memory of 3948	736	svchost.exe	139
PID 736 wrote to memory of 1896	736	svchost.exe	140
PID 736 wrote to memory of 3360	736	svchost.exe	141
PID 736 wrote to memory of 3524	736	svchost.exe	142
PID 736 wrote to memory of 1080	736	svchost.exe	143
PID 736 wrote to memory of 1168	736	svchost.exe	144
PID 736 wrote to memory of 4272	736	svchost.exe	145
PID 736 wrote to memory of 3032	736	svchost.exe	146
PID 736 wrote to memory of 3468	736	svchost.exe	147
PID 736 wrote to memory of 4380	736	svchost.exe	148
PID 736 wrote to memory of 3164	736	svchost.exe	149
PID 736 wrote to memory of 2492	736	svchost.exe	150
PID 736 wrote to memory of 2596	736	svchost.exe	151
PID 736 wrote to memory of 1764	736	svchost.exe	152
PID 736 wrote to memory of 2268	736	svchost.exe	153
PID 736 wrote to memory of 316	736	svchost.exe	154
PID 736 wrote to memory of 1504	736	svchost.exe	155

C:\Users\Admin\AppData\Local\Temp\2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\system32\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Windows security bypass
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1752
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:2464
  - - C:\Users\Admin\AppData\Roaming\windows.exe
      "C:\Users\Admin\AppData\Roaming\windows.exe"
      4⤵
      Executes dropped EXE
      PID:4708
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:3432
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:1104
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:3452
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:624
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:3852
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:2592
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:3012
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:1716
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:4732
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:4036
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:1384
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:2212
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:4452
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:3884
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:880
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:4796
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:4892
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:824
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:2648
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:4252
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:4652
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:2964
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:1084
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:4596
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:1704
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:3548
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:1708
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:1324
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:644
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:3276
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:1112
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:4284
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:2192
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:2124
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:2400
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:3340
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:4552
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:2300
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:4456
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:4496
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:3948
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:1896
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:3360
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:3524
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:1080
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:1168
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:4272
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:3032
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:3468
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:4380
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:3164
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:2492
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:2596
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:1764
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:2268
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:316
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:1504
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:2996
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:2628
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:2096
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      PID:560
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      PID:4132
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Executes dropped EXE
      PID:3112
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      Executes dropped EXE
      PID:1716
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:2188
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4036
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:2056
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:1960
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:1648
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4372
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1336
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:1616
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4360
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4796
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1088
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:3748
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:3604
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:3836
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:388
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:4224
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:980
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4844
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:2196
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:2440
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:1688
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4652
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:4672
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:4464
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:692
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:3380
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:3640
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:4820
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:1704
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:2408
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:4984
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:4264
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:1324
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:1888
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:4884
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:1052
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:2804
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:1112
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:760
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:3084
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:1744
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:1756
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1576
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:3160
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:3788
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:2924
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1520
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:620
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:2800
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4212
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:4236
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:3980
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:3956
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:3916
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:2624
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:1592
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:3192
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:1080
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:4320
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:4272
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4280
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:3636
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1788
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:2172
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:2688
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:1764
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:2268
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:4240
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4192
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:2636
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:624
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:60
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:2628
  - - C:\Users\Admin\AppData\Roaming\windows.exe
      "C:\Users\Admin\AppData\Roaming\windows.exe"
      4⤵
      PID:2324
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:1232
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:3992
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:1568
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4324
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:2784
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:2136
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:4248
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:2188
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4036
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:3028
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:1648
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4372
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:1336
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:5000
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:3720
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4360
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4796
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1088
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:3748
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4536
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:1492
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:3184
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:4072
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:1724
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4224
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1176
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:980
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4648
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4252
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:2380
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:1376
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4652
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4672
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:4464
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:2676
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:384
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:2512
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:2344
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:3816
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:2216
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4872
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1564
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:1516
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4428
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:5100
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:4884
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:1052
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:2804
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:5004
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:760
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:2092
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4920
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:2868
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1952
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:1596
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:5064
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4696
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:932
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:3788
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:4700
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:2972
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1752
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:3240
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:2800
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:4804
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:3944
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:3244
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:1896
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:2624
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:1592
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:3192
  - - C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe"
      4⤵
      PID:2312
  - - C:\Windows\system32\wbem\WmiPrvSE.exe
      "C:\Windows\system32\wbem\WmiPrvSE.exe"
      4⤵
      PID:2692
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      PID:3996
  - - C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe"
      4⤵
      PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windows.cfg

Path C:\Users\Admin\AppData\Roaming\windows.cfg
Size 43B
SHA256 60ac9f39ba94a6aa7a72586c25cd432a6161d6728ec224dc00a2569c028c274d
MD5 0b7ea5b5bf30d3c601612a4d416ff947
SHA1 94a2329dcfa1e3dbf5f4510d5275afb28fa0048e
SHA512 646d5af14ac12f321d75830adacc71c6c28c1db9d17a5a59a6925322c6f421ee7c567e22692b4eeb2ff3a62fcb52f8a6f6d5655e6c7f37c2074148c303ab7269
MD5 SHA1 SHA512

Submit Download

windows.dll

Path C:\Users\Admin\AppData\Roaming\windows.dll
Size 93KB
SHA256 d2e9720ffb4410814dbbfac3a56985ff90a1f3ba2945735ca9f0e66434f6ed2b
MD5 543ecc8cc4274df60c93a7e27caa8ebf
SHA1 8b385d59ea9d654eea4505da5724f82003d631b2
SHA512 c98b1ca5e4fe0257bf5af2d9814b030515f4ae6fc125795e51b71e387067dfd19a8065b1b4c086244a2d97a28098c752b9bba3136861ca6715a6ef30dacc73cf
SSDEEP 1536:rMwCyeooqYejRxjtjSzXZ05NPYvwHg5yQMRPH6l1FVl1t9Ndt9NdtnxGWk/PZgls:rMwbeooBejR7SzJKNQYAvl1FVl1t9Ndz
TLSH
T17E935B53EF6550ABC455E578C8174A26EBB3F8250301A3DF46E0895A8F5B7E2BE3C603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows.exe

Path C:\Users\Admin\AppData\Roaming\windows.exe
Size 56KB
SHA256 643ec58e82e0272c97c2a59f6020970d881af19c0ad5029db9c958c13b6558c7
MD5 f586835082f632dc8d9404d83bc16316
SHA1 010db07461e45b41c886192df6fd425ba8d42d82
SHA512 4a76272011aa2ef210de6e54ccf2b3d8068dfce8a741256562f2423048d94381d6f30ab47d88c37175fb3c7f6efb08bbd8bd8501789cf4e5bb1dff2455be2425
SSDEEP 768:DPLnVeJ+4jnLejsSOQ3DOIKBL4DbNHeDA/YCN8HVvWc9w3Y1P6j3w:DDVeHnLejsT9k1HeGYbVWc9w3gP6jw
TLSH
T1C5436C1FA2E870D0E47AC27499B28249B97175312B11AAFF15E0D1384F72BD0EB39F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-100-0x00007FF67D750000-0x00007FF67D761000-memory.dmp

Download

memory/736-22-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/736-12-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/736-20-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/736-19-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/736-30-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/736-23-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/736-18-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/896-11-0x0000000140000000-0x0000000140979000-memory.dmp

Download

memory/896-21-0x0000000140000000-0x0000000140979000-memory.dmp

Download

memory/896-7-0x0000000140000000-0x0000000140979000-memory.dmp

Download

memory/896-10-0x0000000140000000-0x0000000140979000-memory.dmp

Download

memory/896-0-0x0000000140000000-0x0000000140979000-memory.dmp

Download

memory/896-9-0x0000000140000000-0x0000000140979000-memory.dmp

Download

memory/896-8-0x0000000140000000-0x0000000140979000-memory.dmp

Download

memory/1104-92-0x00007FFFDD730000-0x00007FFFDD925000-memory.dmp

Download

memory/1184-55-0x0000023CB1290000-0x0000023CB1291000-memory.dmp

Download

memory/1184-45-0x0000023CB11F0000-0x0000023CB11F1000-memory.dmp

Download

memory/1184-72-0x0000023CB13A0000-0x0000023CB13A1000-memory.dmp

Download

memory/1184-71-0x0000023CB1390000-0x0000023CB1391000-memory.dmp

Download

memory/1184-70-0x0000023CB1380000-0x0000023CB1381000-memory.dmp

Download

memory/1184-69-0x0000023CB1370000-0x0000023CB1371000-memory.dmp

Download

memory/1184-68-0x0000023CB1360000-0x0000023CB1361000-memory.dmp

Download

memory/1184-67-0x0000023CB1350000-0x0000023CB1351000-memory.dmp

Download

memory/1184-66-0x0000023CB1340000-0x0000023CB1341000-memory.dmp

Download

memory/1184-65-0x0000023CB1330000-0x0000023CB1331000-memory.dmp

Download

memory/1184-64-0x0000023CB1320000-0x0000023CB1321000-memory.dmp

Download

memory/1184-63-0x0000023CB1310000-0x0000023CB1311000-memory.dmp

Download

memory/1184-62-0x0000023CB1300000-0x0000023CB1301000-memory.dmp

Download

memory/1184-61-0x0000023CB12F0000-0x0000023CB12F1000-memory.dmp

Download

memory/1184-60-0x0000023CB12E0000-0x0000023CB12E1000-memory.dmp

Download

memory/1184-59-0x0000023CB12D0000-0x0000023CB12D1000-memory.dmp

Download

memory/1184-58-0x0000023CB12C0000-0x0000023CB12C1000-memory.dmp

Download

memory/1184-57-0x0000023CB12B0000-0x0000023CB12B1000-memory.dmp

Download

memory/1184-56-0x0000023CB12A0000-0x0000023CB12A1000-memory.dmp

Download

memory/1184-74-0x0000023CB13C0000-0x0000023CB13C1000-memory.dmp

Download

memory/1184-54-0x0000023CB1280000-0x0000023CB1281000-memory.dmp

Download

memory/1184-53-0x0000023CB1270000-0x0000023CB1271000-memory.dmp

Download

memory/1184-52-0x0000023CB1260000-0x0000023CB1261000-memory.dmp

Download

memory/1184-51-0x0000023CB1250000-0x0000023CB1251000-memory.dmp

Download

memory/1184-50-0x0000023CB1240000-0x0000023CB1241000-memory.dmp

Download

memory/1184-49-0x0000023CB1230000-0x0000023CB1231000-memory.dmp

Download

memory/1184-48-0x0000023CB1220000-0x0000023CB1221000-memory.dmp

Download

memory/1184-47-0x0000023CB1210000-0x0000023CB1211000-memory.dmp

Download

memory/1184-46-0x0000023CB1200000-0x0000023CB1201000-memory.dmp

Download

memory/1184-73-0x0000023CB13B0000-0x0000023CB13B1000-memory.dmp

Download

memory/1184-224-0x00007FFFCE9C0000-0x00007FFFCE9E2000-memory.dmp

Download

memory/1184-44-0x0000023CB11E0000-0x0000023CB11E1000-memory.dmp

Download

memory/1184-43-0x0000023CB11D0000-0x0000023CB11D1000-memory.dmp

Download

memory/1184-42-0x0000023CB11C0000-0x0000023CB11C1000-memory.dmp

Download

memory/1184-41-0x0000023CB11B0000-0x0000023CB11B1000-memory.dmp

Download

memory/1184-40-0x0000023CB11A0000-0x0000023CB11A1000-memory.dmp

Download

memory/1184-39-0x0000023CB1190000-0x0000023CB1191000-memory.dmp

Download

memory/1184-38-0x0000023CB1180000-0x0000023CB1181000-memory.dmp

Download

memory/1184-37-0x0000023CB1170000-0x0000023CB1171000-memory.dmp

Download

memory/1184-36-0x0000023CB1160000-0x0000023CB1161000-memory.dmp

Download

memory/1184-208-0x00007FFFCE9C0000-0x00007FFFCE9E2000-memory.dmp

Download

memory/1184-75-0x0000023CB13D0000-0x0000023CB13D1000-memory.dmp

Download

memory/1184-76-0x0000023CB13E0000-0x0000023CB13E1000-memory.dmp

Download

memory/1184-77-0x0000023CB13F0000-0x0000023CB13F1000-memory.dmp

Download

memory/1184-78-0x0000023CB1400000-0x0000023CB1401000-memory.dmp

Download

memory/1184-79-0x0000023CB1410000-0x0000023CB1411000-memory.dmp

Download

memory/1184-190-0x00007FFFCE9C0000-0x00007FFFCE9E2000-memory.dmp

Download

memory/1184-91-0x00007FFFCE9C0000-0x00007FFFCE9E2000-memory.dmp

Download

memory/1184-80-0x00007FFFDD7CD000-0x00007FFFDD7CE000-memory.dmp

Download

memory/1184-143-0x00007FFFCE9C0000-0x00007FFFCE9E2000-memory.dmp

Download

memory/1184-34-0x0000023CB1150000-0x0000023CB1151000-memory.dmp

Download

memory/1752-35-0x00007FF727A30000-0x00007FF727A41000-memory.dmp

Download

memory/2464-81-0x00007FFFDD730000-0x00007FFFDD925000-memory.dmp

Download

memory/2592-108-0x00007FF67D750000-0x00007FF67D761000-memory.dmp

Download

memory/3012-112-0x00007FFFDD730000-0x00007FFFDD925000-memory.dmp

Download

memory/3012-156-0x00007FFFDD730000-0x00007FFFDD925000-memory.dmp

Download

memory/3432-90-0x00007FF727A30000-0x00007FF727A41000-memory.dmp

Download

memory/3452-96-0x00007FF67D750000-0x00007FF67D761000-memory.dmp

Download

memory/3852-104-0x00007FF67D750000-0x00007FF67D761000-memory.dmp

Download