54e34f37082532c4acc38df72191292be7fc04621a258f2712b21375fa2cfdc4

Analysis

max time kernel
37s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc3c060e5bc498d60bf64880100e5b7f.exe
Size

50KB
MD5

bc3c060e5bc498d60bf64880100e5b7f
SHA1

028198dae630b2c348c4e184945fce677e4fe4b4
SHA256

54e34f37082532c4acc38df72191292be7fc04621a258f2712b21375fa2cfdc4
SHA512

f775de90b0e523b5adc0b8f10317d7f25bc597a588cdf09afe88d56fef4cdb941bbde24dcbc9383e64206d60c8db558cb6c594b1f537a9a5f728211ee004b6be
SSDEEP

1536:oHdZYzwsjwvtV3NvcqhEzfXzeBU1aps6QfqBMb+8:oHEzwmw79viz/zeBU1aps6Q+MK8

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1648	icf.exe
3000	icf.exe
2856	icf.exe
2700	icf.exe
2508	icf.exe
764	icf.exe
2560	icf.exe
2664	icf.exe
2564	icf.exe
2672	icf.exe
2864	icf.exe
2188	icf.exe
2440	icf.exe
2584	icf.exe
2684	icf.exe
2428	icf.exe
2476	icf.exe
612	icf.exe
464	icf.exe
1040	icf.exe
2760	icf.exe
2588	icf.exe
1960	icf.exe
2244	icf.exe
1420	icf.exe
1952	icf.exe
1556	icf.exe
328	icf.exe
2472	icf.exe
2400	icf.exe
2768	icf.exe
1964	icf.exe
1356	icf.exe
560	icf.exe
1692	icf.exe
2728	icf.exe
2784	icf.exe
2772	icf.exe
320	icf.exe
860	icf.exe
1684	icf.exe
2792	icf.exe
624	icf.exe
1344	icf.exe
1224	icf.exe
1772	icf.exe
2812	icf.exe
2844	icf.exe
2832	icf.exe
2596	icf.exe
2800	icf.exe
3068	icf.exe
2316	icf.exe
2196	icf.exe
1988	icf.exe
2308	icf.exe
1408	icf.exe
1076	icf.exe
1164	icf.exe
1980	icf.exe
2512	icf.exe
2384	icf.exe
2280	icf.exe
512	icf.exe

Loads dropped DLL 64 IoCs

pid	Process
1992	bc3c060e5bc498d60bf64880100e5b7f.exe
1992	bc3c060e5bc498d60bf64880100e5b7f.exe
1648	icf.exe
1648	icf.exe
3000	icf.exe
3000	icf.exe
2856	icf.exe
2856	icf.exe
2700	icf.exe
2700	icf.exe
2508	icf.exe
2508	icf.exe
764	icf.exe
764	icf.exe
2560	icf.exe
2560	icf.exe
2664	icf.exe
2664	icf.exe
2564	icf.exe
2564	icf.exe
2672	icf.exe
2672	icf.exe
2864	icf.exe
2864	icf.exe
2188	icf.exe
2188	icf.exe
2440	icf.exe
2440	icf.exe
2584	icf.exe
2584	icf.exe
2684	icf.exe
2684	icf.exe
2428	icf.exe
2428	icf.exe
2476	icf.exe
2476	icf.exe
612	icf.exe
612	icf.exe
464	icf.exe
464	icf.exe
1040	icf.exe
1040	icf.exe
2760	icf.exe
2760	icf.exe
2588	icf.exe
2588	icf.exe
1960	icf.exe
1960	icf.exe
2244	icf.exe
2244	icf.exe
1420	icf.exe
1420	icf.exe
1952	icf.exe
1952	icf.exe
1556	icf.exe
1556	icf.exe
328	icf.exe
328	icf.exe
2472	icf.exe
2472	icf.exe
2400	icf.exe
2400	icf.exe
2768	icf.exe
2768	icf.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1992-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/files/0x000900000001227d-2.dat	upx
behavioral1/memory/1648-14-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/764-30-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/2564-41-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/2864-56-0x0000000000330000-0x0000000000352000-memory.dmp	upx
behavioral1/memory/1040-84-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1964-100-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1692-104-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1164-116-0x0000000000300000-0x0000000000322000-memory.dmp	upx
behavioral1/memory/988-126-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe"	icf.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe
File created	\??\c:\windows\SysWOW64\icf.exe	icf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1648	1992	bc3c060e5bc498d60bf64880100e5b7f.exe	27
PID 1992 wrote to memory of 1648	1992	bc3c060e5bc498d60bf64880100e5b7f.exe	27
PID 1992 wrote to memory of 1648	1992	bc3c060e5bc498d60bf64880100e5b7f.exe	27
PID 1992 wrote to memory of 1648	1992	bc3c060e5bc498d60bf64880100e5b7f.exe	27
PID 1648 wrote to memory of 3000	1648	icf.exe	28
PID 1648 wrote to memory of 3000	1648	icf.exe	28
PID 1648 wrote to memory of 3000	1648	icf.exe	28
PID 1648 wrote to memory of 3000	1648	icf.exe	28
PID 3000 wrote to memory of 2856	3000	icf.exe	29
PID 3000 wrote to memory of 2856	3000	icf.exe	29
PID 3000 wrote to memory of 2856	3000	icf.exe	29
PID 3000 wrote to memory of 2856	3000	icf.exe	29
PID 2856 wrote to memory of 2700	2856	icf.exe	30
PID 2856 wrote to memory of 2700	2856	icf.exe	30
PID 2856 wrote to memory of 2700	2856	icf.exe	30
PID 2856 wrote to memory of 2700	2856	icf.exe	30
PID 2700 wrote to memory of 2508	2700	icf.exe	31
PID 2700 wrote to memory of 2508	2700	icf.exe	31
PID 2700 wrote to memory of 2508	2700	icf.exe	31
PID 2700 wrote to memory of 2508	2700	icf.exe	31
PID 2508 wrote to memory of 764	2508	icf.exe	32
PID 2508 wrote to memory of 764	2508	icf.exe	32
PID 2508 wrote to memory of 764	2508	icf.exe	32
PID 2508 wrote to memory of 764	2508	icf.exe	32
PID 764 wrote to memory of 2560	764	icf.exe	33
PID 764 wrote to memory of 2560	764	icf.exe	33
PID 764 wrote to memory of 2560	764	icf.exe	33
PID 764 wrote to memory of 2560	764	icf.exe	33
PID 2560 wrote to memory of 2664	2560	icf.exe	34
PID 2560 wrote to memory of 2664	2560	icf.exe	34
PID 2560 wrote to memory of 2664	2560	icf.exe	34
PID 2560 wrote to memory of 2664	2560	icf.exe	34
PID 2664 wrote to memory of 2564	2664	icf.exe	35
PID 2664 wrote to memory of 2564	2664	icf.exe	35
PID 2664 wrote to memory of 2564	2664	icf.exe	35
PID 2664 wrote to memory of 2564	2664	icf.exe	35
PID 2564 wrote to memory of 2672	2564	icf.exe	36
PID 2564 wrote to memory of 2672	2564	icf.exe	36
PID 2564 wrote to memory of 2672	2564	icf.exe	36
PID 2564 wrote to memory of 2672	2564	icf.exe	36
PID 2672 wrote to memory of 2864	2672	icf.exe	37
PID 2672 wrote to memory of 2864	2672	icf.exe	37
PID 2672 wrote to memory of 2864	2672	icf.exe	37
PID 2672 wrote to memory of 2864	2672	icf.exe	37
PID 2864 wrote to memory of 2188	2864	icf.exe	38
PID 2864 wrote to memory of 2188	2864	icf.exe	38
PID 2864 wrote to memory of 2188	2864	icf.exe	38
PID 2864 wrote to memory of 2188	2864	icf.exe	38
PID 2188 wrote to memory of 2440	2188	icf.exe	39
PID 2188 wrote to memory of 2440	2188	icf.exe	39
PID 2188 wrote to memory of 2440	2188	icf.exe	39
PID 2188 wrote to memory of 2440	2188	icf.exe	39
PID 2440 wrote to memory of 2584	2440	icf.exe	40
PID 2440 wrote to memory of 2584	2440	icf.exe	40
PID 2440 wrote to memory of 2584	2440	icf.exe	40
PID 2440 wrote to memory of 2584	2440	icf.exe	40
PID 2584 wrote to memory of 2684	2584	icf.exe	41
PID 2584 wrote to memory of 2684	2584	icf.exe	41
PID 2584 wrote to memory of 2684	2584	icf.exe	41
PID 2584 wrote to memory of 2684	2584	icf.exe	41
PID 2684 wrote to memory of 2428	2684	icf.exe	42
PID 2684 wrote to memory of 2428	2684	icf.exe	42
PID 2684 wrote to memory of 2428	2684	icf.exe	42
PID 2684 wrote to memory of 2428	2684	icf.exe	42

C:\Users\Admin\AppData\Local\Temp\bc3c060e5bc498d60bf64880100e5b7f.exe
"C:\Users\Admin\AppData\Local\Temp\bc3c060e5bc498d60bf64880100e5b7f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992
- \??\c:\windows\SysWOW64\icf.exe
  c:\windows\system32\icf.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1648
- - \??\c:\windows\SysWOW64\icf.exe
    c:\windows\system32\icf.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - \??\c:\windows\SysWOW64\icf.exe
      c:\windows\system32\icf.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2856
    - - \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2700
      - \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2428
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2476
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:612
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:464
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1040
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2760
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2588
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1960
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2244
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1420
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1952
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1556
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:328
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2472
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2400
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2768
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        33⤵
        Executes dropped EXE
        
        PID:1964
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        34⤵
        Executes dropped EXE
        
        PID:1356
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:560
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        36⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1692
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        37⤵
        Executes dropped EXE
        
        PID:2728
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        38⤵
        Executes dropped EXE
        
        PID:2784
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        39⤵
        Executes dropped EXE
        
        PID:2772
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        40⤵
        Executes dropped EXE
        
        PID:320
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        41⤵
        Executes dropped EXE
        
        PID:860
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        42⤵
        Executes dropped EXE
        
        PID:1684
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        43⤵
        Executes dropped EXE
        
        PID:2792
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        44⤵
        Executes dropped EXE
        
        PID:624
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        45⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1344
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        46⤵
        Executes dropped EXE
        
        PID:1224
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        47⤵
        Executes dropped EXE
        
        PID:1772
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        48⤵
        Executes dropped EXE
        
        PID:2812
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        49⤵
        Executes dropped EXE
        
        PID:2844
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        50⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2832
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        51⤵
        Executes dropped EXE
        
        PID:2596
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        52⤵
        Executes dropped EXE
        
        PID:2800
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        53⤵
        Executes dropped EXE
        
        PID:3068
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        54⤵
        Executes dropped EXE
        
        PID:2316
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        55⤵
        Executes dropped EXE
        
        PID:2196
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        56⤵
        Executes dropped EXE
        
        PID:1988
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        57⤵
        Executes dropped EXE
        
        PID:2308
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        58⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1408
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        59⤵
        Executes dropped EXE
        
        PID:1076
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        60⤵
        Executes dropped EXE
        
        PID:1164
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        61⤵
        Executes dropped EXE
        
        PID:1980
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        62⤵
        Executes dropped EXE
        
        PID:2512
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2384
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        64⤵
        Executes dropped EXE
        
        PID:2280
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        65⤵
        Executes dropped EXE
        
        PID:512
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        66⤵
        
        PID:2936
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        67⤵
        
        PID:604
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        68⤵
        
        PID:1548
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        69⤵
        
        PID:1784
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        70⤵
        
        PID:1884
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        71⤵
        
        PID:1592
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        72⤵
        
        PID:2880
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        73⤵
        
        PID:1072
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        74⤵
        
        PID:2128
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        75⤵
        
        PID:1424
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        76⤵
        
        PID:1912
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        77⤵
        
        PID:988
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        78⤵
        
        PID:1332
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        79⤵
        
        PID:1888
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        80⤵
        
        PID:1816
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        81⤵
        
        PID:952
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        82⤵
        
        PID:2884
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        83⤵
        
        PID:1824
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        84⤵
        
        PID:1088
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        85⤵
        
        PID:2060
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        86⤵
        
        PID:1084
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        87⤵
        
        PID:1208
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        88⤵
        
        PID:1008
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        89⤵
        
        PID:2176
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        90⤵
        
        PID:2368
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        91⤵
        
        PID:2364
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        92⤵
        
        PID:1296
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        93⤵
        Adds Run key to start application
        
        PID:2264
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        94⤵
        
        PID:1324
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        95⤵
        
        PID:2112
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        96⤵
        
        PID:2248
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        97⤵
        
        PID:1944
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        98⤵
        
        PID:2312
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        99⤵
        
        PID:1492
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        100⤵
        
        PID:2000
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        101⤵
        
        PID:1516
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        102⤵
        
        PID:1996
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        103⤵
        
        PID:2220
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        104⤵
        
        PID:2320
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        105⤵
        
        PID:1904
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        106⤵
        
        PID:2040
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        107⤵
        
        PID:2116
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        108⤵
        
        PID:1656
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        109⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1668
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        110⤵
        
        PID:2340
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        111⤵
        
        PID:2908
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        112⤵
        
        PID:2920
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        113⤵
        
        PID:2500
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        114⤵
        
        PID:2932
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        115⤵
        
        PID:2984
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        116⤵
        
        PID:2852
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        117⤵
        
        PID:2600
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        118⤵
        
        PID:2192
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        119⤵
        
        PID:1144
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        120⤵
        
        PID:2556
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        121⤵
        
        PID:2520
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        122⤵
        
        PID:2632
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        123⤵
        
        PID:2676
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        124⤵
        
        PID:2660
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        125⤵
        
        PID:2680
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        126⤵
        
        PID:2644
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        127⤵
        
        PID:2688
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        128⤵
        
        PID:2528
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        129⤵
        
        PID:2964
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        130⤵
        
        PID:2456
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        131⤵
        
        PID:2524
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        132⤵
        Drops file in System32 directory
        
        PID:2628
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        133⤵
        
        PID:2424
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        134⤵
        
        PID:2548
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        135⤵
        Adds Run key to start application
        
        PID:2460
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        136⤵
        
        PID:804
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        137⤵
        
        PID:3008
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        138⤵
        
        PID:556
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        139⤵
        
        PID:1152
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        140⤵
        
        PID:1484
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        141⤵
        Drops file in System32 directory
        
        PID:1176
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        142⤵
        
        PID:1604
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        143⤵
        
        PID:1936
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        144⤵
        
        PID:1672
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        145⤵
        
        PID:2544
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        146⤵
        
        PID:1480
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        147⤵
        
        PID:576
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        148⤵
        
        PID:2724
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        149⤵
        Drops file in System32 directory
        
        PID:884
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        150⤵
        Drops file in System32 directory
        
        PID:872
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        151⤵
        
        PID:1724
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        152⤵
        
        PID:2020
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        153⤵
        
        PID:1564
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        154⤵
        
        PID:1704
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        155⤵
        Drops file in System32 directory
        
        PID:832
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        156⤵
        Drops file in System32 directory
        
        PID:1716
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        157⤵
        Adds Run key to start application
        
        PID:1116
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        158⤵
        
        PID:2504
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        159⤵
        
        PID:568
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        160⤵
        
        PID:1416
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        161⤵
        
        PID:1896
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        162⤵
        
        PID:2036
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        163⤵
        
        PID:340
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        164⤵
        
        PID:1876
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        165⤵
        
        PID:1828
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        166⤵
        
        PID:2004
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        167⤵
        
        PID:332
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        168⤵
        
        PID:2300
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        169⤵
        
        PID:2540
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        170⤵
        
        PID:2148
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        171⤵
        
        PID:2332
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        172⤵
        
        PID:2848
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        173⤵
        
        PID:2412
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        174⤵
        
        PID:2492
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        175⤵
        
        PID:2480
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        176⤵
        
        PID:776
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        177⤵
        
        PID:2780
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        178⤵
        
        PID:1576
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        179⤵
        
        PID:1764
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        180⤵
        
        PID:1488
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        181⤵
        
        PID:304
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        182⤵
        Adds Run key to start application
        
        PID:2788
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        183⤵
        
        PID:2708
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        184⤵
        
        PID:1156
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        185⤵
        
        PID:2804
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        186⤵
        
        PID:436
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        187⤵
        
        PID:1728
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        188⤵
        
        PID:960
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        189⤵
        
        PID:820
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        190⤵
        
        PID:2164
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        191⤵
        
        PID:1624
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        192⤵
        
        PID:2696
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        193⤵
        
        PID:2912
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        194⤵
        
        PID:2612
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        195⤵
        Adds Run key to start application
        
        PID:2076
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        196⤵
        
        PID:3080
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        197⤵
        
        PID:3088
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        198⤵
        
        PID:3096
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        199⤵
        
        PID:3104
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        200⤵
        
        PID:3112
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        201⤵
        
        PID:3120
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        202⤵
        
        PID:3128
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        203⤵
        
        PID:3136
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        204⤵
        
        PID:3144
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        205⤵
        Drops file in System32 directory
        
        PID:3152
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        206⤵
        
        PID:3160
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        207⤵
        Drops file in System32 directory
        
        PID:3172
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        208⤵
        
        PID:3180
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        209⤵
        
        PID:3196
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        210⤵
        Adds Run key to start application
        
        PID:3204
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        211⤵
        
        PID:3212
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        212⤵
        
        PID:3220
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        213⤵
        
        PID:3228
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        214⤵
        
        PID:3236
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        215⤵
        Drops file in System32 directory
        
        PID:3244
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        216⤵
        
        PID:3252
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        217⤵
        Drops file in System32 directory
        
        PID:3260
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        218⤵
        Adds Run key to start application
        
        PID:3268
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        219⤵
        
        PID:3276
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        220⤵
        
        PID:3284
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        221⤵
        
        PID:3292
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        222⤵
        
        PID:3300
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        223⤵
        
        PID:3308
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        224⤵
        
        PID:3316
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        225⤵
        
        PID:3324
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        226⤵
        
        PID:3332
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        227⤵
        
        PID:3340
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        228⤵
        Drops file in System32 directory
        
        PID:3348
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        229⤵
        
        PID:3356
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        230⤵
        
        PID:3364
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        231⤵
        
        PID:3372
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        232⤵
        
        PID:3384
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        233⤵
        
        PID:3392
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        234⤵
        Adds Run key to start application
        
        PID:3400
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        235⤵
        
        PID:3408
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        236⤵
        
        PID:3416
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        237⤵
        
        PID:3424
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        238⤵
        
        PID:3432
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        239⤵
        Adds Run key to start application
        
        PID:3440
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        240⤵
        
        PID:3448
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        241⤵
        
        PID:3456
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        242⤵
        Adds Run key to start application
        
        PID:3464
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        243⤵
        
        PID:3472
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        244⤵
        
        PID:3480
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        245⤵
        
        PID:3488
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        246⤵
        
        PID:3496
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        247⤵
        
        PID:3504
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        248⤵
        
        PID:3512
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        249⤵
        
        PID:3520
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        250⤵
        
        PID:3528
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        251⤵
        
        PID:3536
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        252⤵
        
        PID:3544
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        253⤵
        Adds Run key to start application
        
        PID:3552
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        254⤵
        
        PID:3560
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        255⤵
        
        PID:3568
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        256⤵
        Adds Run key to start application
        
        PID:3576
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        257⤵
        
        PID:3584
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        258⤵
        
        PID:3592
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        259⤵
        Adds Run key to start application
        
        PID:3600
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        260⤵
        
        PID:3612
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        261⤵
        
        PID:3620
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        262⤵
        
        PID:3636
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        263⤵
        
        PID:3652
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        264⤵
        
        PID:3664
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        265⤵
        Drops file in System32 directory
        
        PID:3680
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        266⤵
        
        PID:3692
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        267⤵
        
        PID:3704
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        268⤵
        
        PID:3716
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        269⤵
        
        PID:3728
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        270⤵
        
        PID:3740
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        271⤵
        
        PID:3752
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        272⤵
        
        PID:3764
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        273⤵
        Adds Run key to start application
        
        PID:3776
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        274⤵
        
        PID:3788
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        275⤵
        
        PID:3804
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        276⤵
        
        PID:3816
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        277⤵
        
        PID:3828
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        278⤵
        
        PID:3844
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        279⤵
        
        PID:3856
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        280⤵
        
        PID:3868
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        281⤵
        
        PID:3880
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        282⤵
        
        PID:3892
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        283⤵
        Adds Run key to start application
        
        PID:3908
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        284⤵
        
        PID:3920
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        285⤵
        
        PID:3932
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        286⤵
        
        PID:3940
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        287⤵
        
        PID:3948
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        288⤵
        
        PID:3956
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        289⤵
        
        PID:3964
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        290⤵
        
        PID:3972
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        291⤵
        
        PID:3980
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        292⤵
        Drops file in System32 directory
        
        PID:3988
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        293⤵
        
        PID:3996
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        294⤵
        
        PID:4004
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        295⤵
        
        PID:4012
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        296⤵
        Drops file in System32 directory
        
        PID:4020
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        297⤵
        
        PID:4028
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        298⤵
        
        PID:4040
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        299⤵
        
        PID:4048
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        300⤵
        
        PID:4056
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        301⤵
        
        PID:4064
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        302⤵
        
        PID:4072
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        303⤵
        
        PID:4080
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        304⤵
        
        PID:4088
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        305⤵
        
        PID:876
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        306⤵
        
        PID:3192
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        307⤵
        
        PID:3380
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        308⤵
        
        PID:3632
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        309⤵
        
        PID:3648
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        310⤵
        Adds Run key to start application
        
        PID:3672
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        311⤵
        
        PID:3688
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        312⤵
        
        PID:3712
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        313⤵
        
        PID:3736
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        314⤵
        
        PID:3760
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        315⤵
        
        PID:3784
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        316⤵
        
        PID:3800
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        317⤵
        
        PID:3824
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        318⤵
        Drops file in System32 directory
        
        PID:3840
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        319⤵
        
        PID:3864
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        320⤵
        
        PID:3888
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        321⤵
        
        PID:3904
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        322⤵
        Drops file in System32 directory
        
        PID:3928
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        323⤵
        
        PID:4036
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        324⤵
        
        PID:4108
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        325⤵
        
        PID:4116
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        326⤵
        
        PID:4124
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        327⤵
        
        PID:4132
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        328⤵
        Adds Run key to start application
        
        PID:4140
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        329⤵
        
        PID:4148
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        330⤵
        
        PID:4156
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        331⤵
        
        PID:4164
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        332⤵
        
        PID:4172
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        333⤵
        
        PID:4180
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        334⤵
        
        PID:4188
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        335⤵
        Adds Run key to start application
        
        PID:4196
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        336⤵
        
        PID:4204
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        337⤵
        
        PID:4212
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        338⤵
        
        PID:4220
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        339⤵
        Drops file in System32 directory
        
        PID:4228
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        340⤵
        
        PID:4236
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        341⤵
        
        PID:4244
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        342⤵
        
        PID:4252
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        343⤵
        
        PID:4260
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        344⤵
        
        PID:4268
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        345⤵
        
        PID:4276
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        346⤵
        Drops file in System32 directory
        
        PID:4284
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        347⤵
        
        PID:4292
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        348⤵
        
        PID:4300
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        349⤵
        Drops file in System32 directory
        
        PID:4308
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        350⤵
        
        PID:4316
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        351⤵
        
        PID:4324
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        352⤵
        Drops file in System32 directory
        
        PID:4332
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        353⤵
        
        PID:4340
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        354⤵
        
        PID:4348
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        355⤵
        
        PID:4360
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        356⤵
        
        PID:4368
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        357⤵
        
        PID:4376
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        358⤵
        
        PID:4384
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        359⤵
        Drops file in System32 directory
        
        PID:4392
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        360⤵
        Adds Run key to start application
        
        PID:4400
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        361⤵
        
        PID:4408
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        362⤵
        
        PID:4416
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        363⤵
        
        PID:4424
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        364⤵
        Drops file in System32 directory
        
        PID:4432
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        365⤵
        
        PID:4440
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        366⤵
        
        PID:4448
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        367⤵
        
        PID:4456
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        368⤵
        
        PID:4464
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        369⤵
        
        PID:4472
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        370⤵
        Adds Run key to start application
        
        PID:4480
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        371⤵
        
        PID:4488
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        372⤵
        
        PID:4496
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        373⤵
        
        PID:4504
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        374⤵
        
        PID:4512
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        375⤵
        
        PID:4520
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        376⤵
        
        PID:4528
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        377⤵
        Adds Run key to start application
        
        PID:4536
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        378⤵
        
        PID:4544
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        379⤵
        
        PID:4552
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        380⤵
        Drops file in System32 directory
        
        PID:4560
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        381⤵
        
        PID:4568
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        382⤵
        
        PID:4580
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        383⤵
        
        PID:4588
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        384⤵
        
        PID:4596
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        385⤵
        
        PID:4604
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        386⤵
        Drops file in System32 directory
        
        PID:4612
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        387⤵
        
        PID:4620
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        388⤵
        
        PID:4628
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        389⤵
        
        PID:4636
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        390⤵
        Adds Run key to start application
        
        PID:4644
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        391⤵
        
        PID:4652
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        392⤵
        
        PID:4660
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        393⤵
        
        PID:4668
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        394⤵
        
        PID:4676
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        395⤵
        
        PID:4684
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        396⤵
        
        PID:4692
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        397⤵
        
        PID:4700
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        398⤵
        Drops file in System32 directory
        
        PID:4708
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        399⤵
        
        PID:4716
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        400⤵
        
        PID:4724
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        401⤵
        Adds Run key to start application
        
        PID:4732
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        402⤵
        Drops file in System32 directory
        
        PID:4740
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        403⤵
        
        PID:4748
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        404⤵
        
        PID:4756
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        405⤵
        
        PID:4764
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        406⤵
        
        PID:4772
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        407⤵
        
        PID:4780
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        408⤵
        Adds Run key to start application
        
        PID:4788
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        409⤵
        
        PID:4796
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        410⤵
        
        PID:4804
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        411⤵
        
        PID:4812
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        412⤵
        
        PID:4820
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        413⤵
        
        PID:4828
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        414⤵
        
        PID:4836
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        415⤵
        
        PID:4848
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        416⤵
        
        PID:4856
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        417⤵
        
        PID:4864
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        418⤵
        
        PID:4872
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        419⤵
        
        PID:4880
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        420⤵
        
        PID:4888
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        421⤵
        
        PID:4896
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        422⤵
        
        PID:4904
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        423⤵
        
        PID:4912
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        424⤵
        
        PID:4920
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        425⤵
        
        PID:4928
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        426⤵
        Adds Run key to start application
        
        PID:4936
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        427⤵
        Drops file in System32 directory
        
        PID:4944
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        428⤵
        
        PID:4952
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        429⤵
        
        PID:4960
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        430⤵
        
        PID:4968
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        431⤵
        
        PID:4976
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        432⤵
        
        PID:4984
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        433⤵
        
        PID:4992
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        434⤵
        
        PID:5000
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        435⤵
        
        PID:5008
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        436⤵
        
        PID:5016
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        437⤵
        
        PID:5024
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        438⤵
        
        PID:5032
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        439⤵
        
        PID:5040
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        440⤵
        
        PID:5048
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        441⤵
        
        PID:5056
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        442⤵
        
        PID:5064
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        443⤵
        
        PID:5072
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        444⤵
        
        PID:5080
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        445⤵
        
        PID:5088
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        446⤵
        
        PID:5100
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        447⤵
        
        PID:5108
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        448⤵
        
        PID:4104
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        449⤵
        Adds Run key to start application
        
        PID:4576
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        450⤵
        
        PID:4844
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        451⤵
        
        PID:5124
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        452⤵
        
        PID:5132
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        453⤵
        
        PID:5140
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        454⤵
        
        PID:5148
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        455⤵
        
        PID:5156
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        456⤵
        
        PID:5164
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        457⤵
        
        PID:5172
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        458⤵
        
        PID:5180
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        459⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5188
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        460⤵
        
        PID:5196
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        461⤵
        
        PID:5204
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        462⤵
        
        PID:5212
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        463⤵
        
        PID:5220
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        464⤵
        
        PID:5228
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        465⤵
        
        PID:5236
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        466⤵
        
        PID:5244
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        467⤵
        
        PID:5252
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        468⤵
        
        PID:5260
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        469⤵
        
        PID:5268
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        470⤵
        
        PID:5276
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        471⤵
        
        PID:5284
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        472⤵
        
        PID:5292
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        473⤵
        
        PID:5300
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        474⤵
        
        PID:5308
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        475⤵
        
        PID:5316
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        476⤵
        Adds Run key to start application
        
        PID:5324
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        477⤵
        
        PID:5332
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        478⤵
        
        PID:5344
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        479⤵
        
        PID:5352
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        480⤵
        
        PID:5360
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        481⤵
        
        PID:5368
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        482⤵
        Drops file in System32 directory
        
        PID:5376
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        483⤵
        
        PID:5384
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        484⤵
        
        PID:5392
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        485⤵
        
        PID:5400
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        486⤵
        Drops file in System32 directory
        
        PID:5408
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        487⤵
        
        PID:5416
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        488⤵
        
        PID:5424
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        489⤵
        Drops file in System32 directory
        
        PID:5432
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        490⤵
        Drops file in System32 directory
        
        PID:5440
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        491⤵
        
        PID:5448
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        492⤵
        
        PID:5456
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        493⤵
        
        PID:5464
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        494⤵
        
        PID:5472
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        495⤵
        
        PID:5480
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        496⤵
        
        PID:5488
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        497⤵
        
        PID:5496
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        498⤵
        
        PID:5504
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        499⤵
        
        PID:5512
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        500⤵
        Drops file in System32 directory
        
        PID:5520
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        501⤵
        
        PID:5528
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        502⤵
        
        PID:5536
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        503⤵
        
        PID:5544
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        504⤵
        
        PID:5556
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        505⤵
        
        PID:5568
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        506⤵
        
        PID:5580
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        507⤵
        
        PID:5596
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        508⤵
        
        PID:5608
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        509⤵
        
        PID:5620
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        510⤵
        Adds Run key to start application
        
        PID:5632
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        511⤵
        
        PID:5644
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        512⤵
        
        PID:5660
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        513⤵
        
        PID:5672
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        514⤵
        
        PID:5684
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        515⤵
        
        PID:5696
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        516⤵
        
        PID:5708
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        517⤵
        
        PID:5720
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        518⤵
        Adds Run key to start application
        
        PID:5732
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        519⤵
        
        PID:5744
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        520⤵
        
        PID:5756
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        521⤵
        
        PID:5768
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        522⤵
        
        PID:5780
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        523⤵
        Drops file in System32 directory
        
        PID:5792
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        524⤵
        
        PID:5804
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        525⤵
        
        PID:5816
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        526⤵
        
        PID:5828
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        527⤵
        
        PID:5840
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        528⤵
        
        PID:5852
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        529⤵
        
        PID:5868
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        530⤵
        Adds Run key to start application
        
        PID:5880
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        531⤵
        
        PID:5892
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        532⤵
        Drops file in System32 directory
        
        PID:5904
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        533⤵
        
        PID:5912
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        534⤵
        Drops file in System32 directory
        
        PID:5920
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        535⤵
        
        PID:5928
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        536⤵
        
        PID:5936
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        537⤵
        Adds Run key to start application
        
        PID:5944
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        538⤵
        
        PID:5952
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        539⤵
        
        PID:5960
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        540⤵
        
        PID:5968
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        541⤵
        Adds Run key to start application
        
        PID:5976
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        542⤵
        Drops file in System32 directory
        
        PID:5984
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        543⤵
        
        PID:5992
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        544⤵
        
        PID:6000
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        545⤵
        
        PID:6008
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        546⤵
        
        PID:6016
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        547⤵
        
        PID:6024
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        548⤵
        
        PID:6032
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        549⤵
        
        PID:6040
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        550⤵
        
        PID:6048
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        551⤵
        Adds Run key to start application
        
        PID:6056
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        552⤵
        
        PID:6068
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        553⤵
        
        PID:6076
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        554⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6084
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        555⤵
        
        PID:6092
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        556⤵
        Adds Run key to start application
        
        PID:6108
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        557⤵
        
        PID:6128
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        558⤵
        
        PID:5340
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        559⤵
        
        PID:5564
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        560⤵
        
        PID:5588
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        561⤵
        
        PID:5628
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        562⤵
        
        PID:5652
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        563⤵
        
        PID:5668
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        564⤵
        
        PID:5692
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        565⤵
        
        PID:5716
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        566⤵
        
        PID:5800
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        567⤵
        
        PID:5876
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        568⤵
        
        PID:5888
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        569⤵
        
        PID:1000
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        570⤵
        
        PID:6152
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        571⤵
        
        PID:6160
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        572⤵
        
        PID:6168
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        573⤵
        
        PID:6176
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        574⤵
        
        PID:6184
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        575⤵
        
        PID:6192
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        576⤵
        
        PID:6200
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        577⤵
        
        PID:6208
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        578⤵
        Drops file in System32 directory
        
        PID:6216
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        579⤵
        
        PID:6224
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        580⤵
        
        PID:6232
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        581⤵
        
        PID:6240
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        582⤵
        
        PID:6248
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        583⤵
        
        PID:6260
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        584⤵
        
        PID:6268
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        585⤵
        
        PID:6276
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        586⤵
        
        PID:6284
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        587⤵
        
        PID:6292
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        588⤵
        
        PID:6300
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        589⤵
        
        PID:6308
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        590⤵
        
        PID:6316
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        591⤵
        
        PID:6324
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        592⤵
        
        PID:6332
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        593⤵
        
        PID:6340
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        594⤵
        Adds Run key to start application
        
        PID:6348
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        595⤵
        
        PID:6356
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        596⤵
        
        PID:6364
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        597⤵
        
        PID:6372
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        598⤵
        Drops file in System32 directory
        
        PID:6380
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        599⤵
        
        PID:6388
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        600⤵
        
        PID:6396
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        601⤵
        
        PID:6404
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        602⤵
        
        PID:6412
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        603⤵
        
        PID:6420
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        604⤵
        
        PID:6428
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        605⤵
        
        PID:6436
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        606⤵
        
        PID:6444
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        607⤵
        
        PID:6452
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        608⤵
        
        PID:6464
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        609⤵
        Adds Run key to start application
        
        PID:6472
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        610⤵
        
        PID:6480
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        611⤵
        
        PID:6488
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        612⤵
        Drops file in System32 directory
        
        PID:6496
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        613⤵
        
        PID:6504
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        614⤵
        
        PID:6512
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        615⤵
        
        PID:6520
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        616⤵
        
        PID:6528
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        617⤵
        
        PID:6536
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        618⤵
        
        PID:6544
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        619⤵
        
        PID:6552
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        620⤵
        Drops file in System32 directory
        
        PID:6560
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        621⤵
        Drops file in System32 directory
        
        PID:6568
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        622⤵
        
        PID:6576
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        623⤵
        Drops file in System32 directory
        
        PID:6584
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        624⤵
        
        PID:6592
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        625⤵
        
        PID:6600
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        626⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6608
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        627⤵
        Adds Run key to start application
        
        PID:6616
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        628⤵
        
        PID:6624
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        629⤵
        
        PID:6632
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        630⤵
        Adds Run key to start application
        
        PID:6640
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        631⤵
        
        PID:6648
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        632⤵
        
        PID:6660
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        633⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6668
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        634⤵
        
        PID:6676
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        635⤵
        
        PID:6684
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        636⤵
        
        PID:6692
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        637⤵
        
        PID:6700
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        638⤵
        
        PID:6708
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        639⤵
        
        PID:6716
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        640⤵
        
        PID:6724
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        641⤵
        
        PID:6732
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        642⤵
        Drops file in System32 directory
        
        PID:6740
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        643⤵
        
        PID:6748
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        644⤵
        
        PID:6756
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        645⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6764
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        646⤵
        
        PID:6772
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        647⤵
        
        PID:6780
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        648⤵
        
        PID:6788
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        649⤵
        Adds Run key to start application
        
        PID:6796
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        650⤵
        
        PID:6804
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        651⤵
        
        PID:6812
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        652⤵
        
        PID:6820
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        653⤵
        
        PID:6828
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        654⤵
        
        PID:6836
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        655⤵
        
        PID:6844
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        656⤵
        Adds Run key to start application
        
        PID:6852
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        657⤵
        Adds Run key to start application
        
        PID:6860
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        658⤵
        
        PID:6868
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        659⤵
        Adds Run key to start application
        
        PID:6876
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        660⤵
        Drops file in System32 directory
        
        PID:6884
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        661⤵
        Adds Run key to start application
        
        PID:6892
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        662⤵
        
        PID:6900
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        663⤵
        
        PID:6908
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        664⤵
        
        PID:6920
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        665⤵
        
        PID:6928
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        666⤵
        
        PID:6936
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        667⤵
        
        PID:6944
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        668⤵
        Drops file in System32 directory
        
        PID:6952
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        669⤵
        Adds Run key to start application
        
        PID:6960
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        670⤵
        Drops file in System32 directory
        
        PID:6968
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        671⤵
        Adds Run key to start application
        
        PID:6976
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        672⤵
        
        PID:6984
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        673⤵
        
        PID:6992
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        674⤵
        Adds Run key to start application
        
        PID:7000
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        675⤵
        
        PID:7008
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        676⤵
        Drops file in System32 directory
        
        PID:7016
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        677⤵
        
        PID:7024
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        678⤵
        
        PID:7032
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        679⤵
        
        PID:7040
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        680⤵
        Adds Run key to start application
        
        PID:7048
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        681⤵
        
        PID:7056
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        682⤵
        
        PID:7064
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        683⤵
        
        PID:7072
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        684⤵
        
        PID:7080
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        685⤵
        
        PID:7088
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        686⤵
        
        PID:7096
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        687⤵
        
        PID:7104
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        688⤵
        
        PID:7112
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        689⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:7120
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        690⤵
        
        PID:7128
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        691⤵
        
        PID:7136
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        692⤵
        
        PID:7144
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        693⤵
        
        PID:7156
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        694⤵
        
        PID:7164
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        695⤵
        
        PID:6256
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        696⤵
        
        PID:6916
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        697⤵
        
        PID:7172
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        698⤵
        
        PID:7180
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        699⤵
        
        PID:7188
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        700⤵
        
        PID:7196
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        701⤵
        
        PID:7204
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        702⤵
        
        PID:7212
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        703⤵
        
        PID:7220
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        704⤵
        Drops file in System32 directory
        
        PID:7228
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        705⤵
        
        PID:7236
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        706⤵
        
        PID:7244
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        707⤵
        
        PID:7252
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        708⤵
        
        PID:7260
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        709⤵
        
        PID:7268
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        710⤵
        
        PID:7276
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        711⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:7284
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        712⤵
        
        PID:7292
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        713⤵
        
        PID:7300
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        714⤵
        
        PID:7308
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        715⤵
        
        PID:7316
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        716⤵
        
        PID:7324
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        717⤵
        
        PID:7332
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        718⤵
        Adds Run key to start application
        
        PID:7340
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        719⤵
        
        PID:7348
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        720⤵
        Drops file in System32 directory
        
        PID:7356
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        721⤵
        
        PID:7364
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        722⤵
        
        PID:7372
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        723⤵
        
        PID:7380
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        724⤵
        
        PID:7396
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        725⤵
        
        PID:7440
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        726⤵
        
        PID:7504
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        727⤵
        
        PID:7556
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        728⤵
        
        PID:7580
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        729⤵
        
        PID:7592
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        730⤵
        
        PID:7608
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        731⤵
        
        PID:7620
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        732⤵
        
        PID:7668
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        733⤵
        
        PID:7676
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        734⤵
        
        PID:7808
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        735⤵
        
        PID:7904
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        736⤵
        
        PID:7936
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        737⤵
        
        PID:8044
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        738⤵
        
        PID:7488
        
        \??\c:\windows\SysWOW64\icf.exe
        
        c:\windows\system32\icf.exe
        739⤵
        
        PID:8776
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        738⤵
        
        PID:5716
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        737⤵
        
        PID:1996
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        731⤵
        
        PID:8204
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        722⤵
        
        PID:5020
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3932163.bat
        714⤵
        
        PID:1428
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        706⤵
        
        PID:9176
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\1900547.bat
        698⤵
        
        PID:9160
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        695⤵
        
        PID:5596
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        676⤵
        
        PID:9056
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2424835.bat
        673⤵
        
        PID:7388
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        668⤵
        
        PID:5980
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        666⤵
        
        PID:2756
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        661⤵
        
        PID:1300
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\4128771.bat
        654⤵
        
        PID:2252
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        652⤵
        
        PID:7304
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        651⤵
        
        PID:2512
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        650⤵
        
        PID:5368
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        639⤵
        
        PID:6832
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        637⤵
        
        PID:2988
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2621443.bat
        627⤵
        
        PID:2796
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3080195.bat
        608⤵
        
        PID:9012
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2621443.bat
        607⤵
        
        PID:1684
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3866627.bat
        596⤵
        
        PID:2224
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        582⤵
        
        PID:8652
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\1900547.bat
        566⤵
        
        PID:8392
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        558⤵
        
        PID:1668
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        549⤵
        
        PID:8484
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2621443.bat
        542⤵
        
        PID:8992
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3080195.bat
        541⤵
        
        PID:9196
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        525⤵
        
        PID:4052
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\1900547.bat
        517⤵
        
        PID:8260
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\1900547.bat
        513⤵
        
        PID:2984
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3866627.bat
        508⤵
        
        PID:8292
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3932163.bat
        492⤵
        
        PID:2968
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3997699.bat
        484⤵
        
        PID:9048
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3866627.bat
        482⤵
        
        PID:8228
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2424835.bat
        472⤵
        
        PID:8916
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        463⤵
        
        PID:3208
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        461⤵
        
        PID:6808
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2424835.bat
        444⤵
        
        PID:8936
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\1900547.bat
        437⤵
        
        PID:9208
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3932163.bat
        434⤵
        
        PID:9168
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        406⤵
        
        PID:8400
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\1900547.bat
        391⤵
        
        PID:9004
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        370⤵
        
        PID:520
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3932163.bat
        369⤵
        
        PID:2180
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        368⤵
        
        PID:9116
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        364⤵
        
        PID:7236
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        357⤵
        
        PID:2800
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        349⤵
        
        PID:4768
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3932163.bat
        335⤵
        
        PID:8252
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        332⤵
        
        PID:8724
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        331⤵
        
        PID:9120
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        329⤵
        
        PID:8656
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3080195.bat
        327⤵
        
        PID:8784
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3932163.bat
        317⤵
        
        PID:8508
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3932163.bat
        310⤵
        
        PID:9152
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2621443.bat
        309⤵
        
        PID:8824
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        300⤵
        
        PID:9088
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        298⤵
        
        PID:2976
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\28639235.bat
        289⤵
        
        PID:8924
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        267⤵
        
        PID:3632
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2883587.bat
        261⤵
        
        PID:8876
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        256⤵
        
        PID:6988
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        249⤵
        
        PID:3612
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        248⤵
        
        PID:952
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        225⤵
        
        PID:8300
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        223⤵
        
        PID:6796
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        222⤵
        
        PID:6612
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\1900547.bat
        211⤵
        
        PID:8716
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3080195.bat
        166⤵
        
        PID:8528
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        160⤵
        
        PID:7652
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2883587.bat
        149⤵
        
        PID:8856
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2424835.bat
        118⤵
        
        PID:8604
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        110⤵
        
        PID:8752
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        103⤵
        
        PID:8852
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3932163.bat
        82⤵
        
        PID:8760
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3866627.bat
        76⤵
        
        PID:1676
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        71⤵
        
        PID:8832
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        69⤵
        
        PID:4936
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        63⤵
        
        PID:7948
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        62⤵
        
        PID:772
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        61⤵
        
        PID:2188
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        60⤵
        
        PID:2940
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        59⤵
        
        PID:992
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        58⤵
        
        PID:2336
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        57⤵
        
        PID:7512
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        55⤵
        
        PID:2672
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        54⤵
        
        PID:8116
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        53⤵
        
        PID:8084
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        51⤵
        
        PID:8080
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        50⤵
        
        PID:2568
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        48⤵
        
        PID:8072
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        47⤵
        
        PID:7540
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        46⤵
        
        PID:7564
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        45⤵
        
        PID:7876
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        44⤵
        
        PID:7864
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        43⤵
        
        PID:7756
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        41⤵
        
        PID:7924
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        40⤵
        
        PID:7732
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        39⤵
        
        PID:7896
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3080195.bat
        38⤵
        
        PID:8512
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        37⤵
        
        PID:7524
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        36⤵
        
        PID:2664
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        35⤵
        
        PID:7548
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        33⤵
        
        PID:7708
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        31⤵
        
        PID:7820
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        30⤵
        
        PID:7728
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        29⤵
        
        PID:7792
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        28⤵
        
        PID:7576
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        27⤵
        
        PID:7784
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        26⤵
        
        PID:7424
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        25⤵
        
        PID:7468
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        24⤵
        
        PID:7412
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3932163.bat
        23⤵
        
        PID:7616
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        22⤵
        
        PID:8100
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        21⤵
        
        PID:8132
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\1835011.bat
        20⤵
        
        PID:7536
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        19⤵
        
        PID:8156
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        18⤵
        
        PID:8120
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        17⤵
        
        PID:7984
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        16⤵
        
        PID:7968
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2359299.bat
        15⤵
        
        PID:7552
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        14⤵
        
        PID:7960
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2555907.bat
        13⤵
        
        PID:7460
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        12⤵
        
        PID:7976
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        11⤵
        
        PID:8000
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\3932163.bat
        10⤵
        
        PID:7888
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        9⤵
        
        PID:7912
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        8⤵
        
        PID:7828
        
        \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\1835011.bat
        7⤵
        
        PID:7760
      - \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2293763.bat
        6⤵
        
        PID:7712
    - - \??\c:\windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\SysWOW64\2818051.bat
        5⤵
        
        PID:7656
  - - \??\c:\windows\SysWOW64\cmd.exe
      cmd /c c:\windows\SysWOW64\2359299.bat
      4⤵
      PID:7524
- - \??\c:\windows\SysWOW64\cmd.exe
    cmd /c c:\windows\SysWOW64\2359299.bat
    3⤵
    PID:7476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\2293763.bat
  2⤵
  PID:7428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2293763.bat

Filesize
235B

MD5
d77a93f6b8d7cbde969057aabab8a2e4

SHA1
261e78279c7f99f01678b30c39ddec32c545851c

SHA256
3d7b9efd43f7a9ca080fcde7b96801f1e86fcb338c796bd59a6ac27332085760

SHA512
826e0709827643bf10b89e77f874f037281872328a7b7a91566ac2e7de74bac7e1eab3eaa62b336347d75756025826127a6981eb5f4940e976bc0464eaeeb9af

Download Submit
C:\Windows\SysWOW64\1835011.bat

Filesize
135B

MD5
0847331fc3d3555ba0bb3aa9660a2871

SHA1
6267dbd0e81ca939bcd55a64f7dc3cee48ba5f97

SHA256
b1a634a86537394faafa068c6ed70ac04bf635dfbe52e3202776d165c737909d

SHA512
300d98d501401961d060fb394c8b8b8939fad0c6ee327e42fda51581bed40573fd7232164089e3e9dbb8f28b7ddf0d58bc1cc1e5c63845b9374b8935ab831949

Download Submit
C:\Windows\SysWOW64\1900547.bat

Filesize
135B

MD5
435e56680f3df9f14c59795e31be4e52

SHA1
7f8f79bfb816e8b5faaf23e81c2254cbb3f56643

SHA256
33a663818ea79e3939e410de136f1d363069831ad95efd9752a0a848027763b7

SHA512
ebc57a820a1fd48a3265e8a83cdc169067b23881d444d6d7774f9a56cc9222dcb2353d47f9d0a3e46a09cf830e82dfab516cbd0c5ea28699ba4feb69c9b482a8

Download Submit
C:\Windows\SysWOW64\2293763.bat

Filesize
135B

MD5
3d1b757a42d19bf7396c703f52e9693a

SHA1
3c359b725d411937d1d9ebf546a927911c7e39b6

SHA256
4187c6ce277fec189f5cbed379b81f8d42ff9ac23013000e7b794981b03804da

SHA512
5c134510a693fc9eeb7f394a5f42da1d62bb1599c94db2a3d290b879bdb83eec50d4c4ec9d6f3d628d31034e20ac3616590e7cf4ac04cfc7efd46a614b648791

Download Submit
C:\Windows\SysWOW64\2359299.bat

Filesize
135B

MD5
bda39eb831716348600e99e69edc23bb

SHA1
6f79e751e2a204330dcd80325d4fd904fcd6f3a9

SHA256
ac14c0cbe64370122eda0e7739c8328db357e6bd207a1980e5c8c1abaccd98d3

SHA512
f64a3e2d4635c134dede41a5cb2000ce33cae92f5af6918f92d0e7e0064b9a8830c00db5f0774c06ea7569a99cbab4f20b69954eafd7a759214be16e0d0fc96b

Download Submit
C:\Windows\SysWOW64\2424835.bat

Filesize
135B

MD5
275828e2e00678d145bfc35004ef2e90

SHA1
ec2d65aa0485521c122b0d4789cf7a3c3503623a

SHA256
30141cd6fe2a2e0b36cbf8183900a0c50e01a5aeead09ab432b0e19be4f57196

SHA512
8bcc75b5a99388ce2ee606c377f197d9c148654a13f3d530165ed45b56cac03706891ab6accc0fc394b3d0f4ad94875be4adcf0ba3dcdd3029b4dc157ac228a0

Download Submit
C:\Windows\SysWOW64\2555907.bat

Filesize
135B

MD5
4bda6b789370c6884251872c638f74e9

SHA1
fe65565c0fed2228e2518b4f59684058126c00b9

SHA256
0738e5380d29249303918a93574bcb7e938e259bc3c9eaf2bb05e3573634996c

SHA512
79e0401b136afdab9da5103427b2351b0b8f897648e807c5b751cb6a2b7f67cc289132cc7e85cf4a60e1775195f10643d86e511b60b090b08f68763a5da94817

Download Submit
C:\Windows\SysWOW64\2621443.bat

Filesize
135B

MD5
5ec0a9d5b397442aa185b8f0848feb71

SHA1
b4404c9cb8161fb355a8f3059e5b9cc62174f21b

SHA256
2de728f618c772a53f693be14ddfc5fabfe017fb3dc5ad45800f799481e7a81c

SHA512
4ef2f790bfbb44c5d9c2f70edb42222e86cb888a5632650bdcd396d1aad3111feca0cf579876b87f75d05544c9ade9febe9d75600d0570c60eb5e09e09d27ead

Download Submit
C:\Windows\SysWOW64\2818051.bat

Filesize
135B

MD5
11097af197f956f6a8a0a238f0591138

SHA1
16ba7f39befca67e84b2f70b2e17519d1ea86f33

SHA256
5c69d1bf795b8471295928bcfa902a6fe496475e59d50677077830f55ce605d0

SHA512
788d4f9bba2c8845c5003351bb5f5cee28ef9ccf9d962b4a7fba0d1b19f24bfd78cb8146ecaf6658df77699ba5ec3b7b998d83acc89f24823606394864c9b65e

Download Submit
C:\Windows\SysWOW64\28639235.bat

Filesize
138B

MD5
2531277767509d17d87388c78ff067fe

SHA1
4fb4ed6556a214d0b7be1b0b441d18eb8b7d16c8

SHA256
43e415bde7edbe2ecdfdda2e08b1780e6cd52dd4fafe33b3f905363794f20c79

SHA512
189e28f12f700f3176d6cb514e87a5f35ff924be5180cf4b35cc6107efe0f4de20b3e739072a7ef05becea12d23eb2b665cc6aa9ce6a2421dd00a7ad53994d35

Download Submit
C:\Windows\SysWOW64\2883587.bat

Filesize
135B

MD5
b1a35fee886d4b56719e526d9583e29d

SHA1
e9602d94dac656e8c6ff48c8073fd4f63c96d900

SHA256
a34fa72d3c60945bdcb4f848578296aae7df6c6170bc230f11da5501b4f02b3a

SHA512
ecc825563b330a78de5925db7a453c21f1b65423f8925b57e2e99d7eb49e3bb2366679ab509a52dd4888ae1d43c0e50c285a1e01e9b919273d65947dc583f745

Download Submit
C:\Windows\SysWOW64\3080195.bat

Filesize
135B

MD5
eb5f718fa26e1e2acb3f9c266f927c6c

SHA1
7e62b4de25eef16c657bae5e537a97aae5c32417

SHA256
53a17d74da20491565d8b8b435cc3c793845fa35191c9735f66a8d8f5cce548b

SHA512
e2fd55cd250427c19abc5d8575dfcf7eed32b4f92e890cd2cf227a71279a37ccd5b3e5ae92110a474c78c41d862af3bd3fbba792e6c27746af847379025cad3d

Download Submit
C:\Windows\SysWOW64\3932163.bat

Filesize
135B

MD5
b511e28630d9a9d378a22dc4a908f630

SHA1
5a87258c3ae8e0e30e12f4dfe3ebfe3df964477b

SHA256
9f0dbc56bf70f897360d04d3bb37b96f59d14d088e96db572d7a3edaea007f06

SHA512
6d8e5a6880b240d5994111ffe0b9c8ee9de3f34881983197cde504b9da6dffb846fdc73324afcfd132b1428be9028b7cd5960fd6233300bee2583c16fa4c103b

Download Submit
C:\Windows\SysWOW64\3997699.bat

Filesize
135B

MD5
6db1f8702ff7bc3a5c834ec36b50017e

SHA1
75166a6e9bbc6053609ba774243f4e7b414d1e9c

SHA256
281b8330991f911858e3997b21017edddbb4c95ecb4d2a5c89a1795af6ee8634

SHA512
e81b5754d61a02296d59954713d8bdbd678e03d7e0754d7548b7179a5307b23863fadde5ae120170f96b3f9d77c6b10fd323784be4d7ca9198a8ecc35da3e504

Download Submit
C:\Windows\SysWOW64\4128771.bat

Filesize
135B

MD5
1ec7dc7873c2888c4fd62e05794be85c

SHA1
f06a676c68d94724b3dc61c34df89c2c94e86531

SHA256
923538754fc2d5ddf39959fd5922a33750d054885670a08c547e200528246400

SHA512
bbee40b14dfdc21d782da50800bea16dc2781fee9d122059a4f29127da2fb36c49e30ac2641dbafddcc452da4023f6c891bd093239ceacbf84d8b7d7ca0509fa

Download Submit
\Windows\SysWOW64\icf.exe

Filesize
50KB

MD5
bc3c060e5bc498d60bf64880100e5b7f

SHA1
028198dae630b2c348c4e184945fce677e4fe4b4

SHA256
54e34f37082532c4acc38df72191292be7fc04621a258f2712b21375fa2cfdc4

SHA512
f775de90b0e523b5adc0b8f10317d7f25bc597a588cdf09afe88d56fef4cdb941bbde24dcbc9383e64206d60c8db558cb6c594b1f537a9a5f728211ee004b6be

Download Submit
memory/464-82-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/464-92-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/604-122-0x00000000002F0000-0x0000000000312000-memory.dmp

Filesize
136KB

Download
memory/624-112-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/764-30-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/860-109-0x00000000003D0000-0x00000000003F2000-memory.dmp

Filesize
136KB

Download
memory/988-126-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/988-127-0x0000000000270000-0x0000000000292000-memory.dmp

Filesize
136KB

Download
memory/1040-84-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1040-95-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1072-129-0x0000000000260000-0x0000000000282000-memory.dmp

Filesize
136KB

Download
memory/1076-120-0x0000000000260000-0x0000000000282000-memory.dmp

Filesize
136KB

Download
memory/1164-117-0x0000000000300000-0x0000000000322000-memory.dmp

Filesize
136KB

Download
memory/1164-116-0x0000000000300000-0x0000000000322000-memory.dmp

Filesize
136KB

Download
memory/1344-111-0x00000000002A0000-0x00000000002C2000-memory.dmp

Filesize
136KB

Download
memory/1344-113-0x00000000002A0000-0x00000000002C2000-memory.dmp

Filesize
136KB

Download
memory/1408-115-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1420-102-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1420-93-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1556-105-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1648-17-0x0000000000260000-0x0000000000282000-memory.dmp

Filesize
136KB

Download
memory/1648-14-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1692-104-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1784-124-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1816-132-0x00000000002D0000-0x00000000002F2000-memory.dmp

Filesize
136KB

Download
memory/1888-130-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1960-98-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1960-90-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1964-108-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download
memory/1964-103-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download
memory/1964-100-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1980-121-0x0000000000280000-0x00000000002A2000-memory.dmp

Filesize
136KB

Download
memory/1992-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1992-9-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1992-37-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/2128-131-0x00000000002E0000-0x0000000000302000-memory.dmp

Filesize
136KB

Download
memory/2188-64-0x0000000000260000-0x0000000000282000-memory.dmp

Filesize
136KB

Download
memory/2196-118-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download
memory/2244-91-0x00000000002F0000-0x0000000000312000-memory.dmp

Filesize
136KB

Download
memory/2244-99-0x00000000002F0000-0x0000000000312000-memory.dmp

Filesize
136KB

Download
memory/2244-101-0x00000000002F0000-0x0000000000312000-memory.dmp

Filesize
136KB

Download
memory/2280-123-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/2308-119-0x00000000002E0000-0x0000000000302000-memory.dmp

Filesize
136KB

Download
memory/2472-97-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/2508-29-0x0000000000280000-0x00000000002A2000-memory.dmp

Filesize
136KB

Download
memory/2508-58-0x0000000000280000-0x00000000002A2000-memory.dmp

Filesize
136KB

Download
memory/2564-41-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2700-25-0x00000000002D0000-0x00000000002F2000-memory.dmp

Filesize
136KB

Download
memory/2700-51-0x00000000002D0000-0x00000000002F2000-memory.dmp

Filesize
136KB

Download
memory/2760-89-0x00000000005C0000-0x00000000005E2000-memory.dmp

Filesize
136KB

Download
memory/2760-94-0x00000000005C0000-0x00000000005E2000-memory.dmp

Filesize
136KB

Download
memory/2760-88-0x00000000005C0000-0x00000000005E2000-memory.dmp

Filesize
136KB

Download
memory/2760-96-0x00000000005C0000-0x00000000005E2000-memory.dmp

Filesize
136KB

Download
memory/2784-107-0x00000000005C0000-0x00000000005E2000-memory.dmp

Filesize
136KB

Download
memory/2784-106-0x00000000005C0000-0x00000000005E2000-memory.dmp

Filesize
136KB

Download
memory/2784-110-0x00000000005C0000-0x00000000005E2000-memory.dmp

Filesize
136KB

Download
memory/2812-114-0x0000000000280000-0x00000000002A2000-memory.dmp

Filesize
136KB

Download
memory/2856-47-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/2864-77-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/2864-53-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/2864-56-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/2864-75-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/2880-128-0x00000000003D0000-0x00000000003F2000-memory.dmp

Filesize
136KB

Download
memory/2936-125-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads