Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 07:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f57ba037a62c2fd6a1c73f5c194a9731_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
f57ba037a62c2fd6a1c73f5c194a9731_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
f57ba037a62c2fd6a1c73f5c194a9731_JaffaCakes118.exe
-
Size
13KB
-
MD5
f57ba037a62c2fd6a1c73f5c194a9731
-
SHA1
fa37049eb0660b2c8db929cd65cb0a0b3336a12e
-
SHA256
e9d5044749a22ab054458df8b4b904732e2b839440844e43c7795ae234124813
-
SHA512
eeb008c72b94cc60748a0fef93997dc85d4b9d2d02d0b8e4e9cb8c5ee91c86229efb109d3032fd7ff96ffe25a4c0813fd0f8ea0ab142bcb7c94decf2d61c873a
-
SSDEEP
384:IS7vcUIUb969kc3yC+bFVVdrl6G6qLR4/sfdGDLLwmMgVWST6Ws:IS/bwzyJbFV7rl7F95fk3kglA
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3408 icf.exe 448 icf.exe 532 icf.exe 4876 icf.exe 4348 icf.exe 5012 icf.exe 3888 icf.exe 1312 icf.exe 1384 icf.exe 1464 icf.exe 660 icf.exe 3492 icf.exe 4196 icf.exe 4856 icf.exe 2944 icf.exe 3664 icf.exe 912 icf.exe 424 icf.exe 1972 icf.exe 1984 icf.exe 2968 icf.exe 436 icf.exe 3720 icf.exe 2724 icf.exe 4056 icf.exe 3120 icf.exe 3008 icf.exe 2260 icf.exe 3924 icf.exe 1920 icf.exe 5084 icf.exe 5036 icf.exe 1540 icf.exe 2240 icf.exe 4404 icf.exe 3160 icf.exe 3640 icf.exe 4744 icf.exe 3320 icf.exe 3312 icf.exe 1308 icf.exe 960 icf.exe 4320 icf.exe 3848 icf.exe 3748 icf.exe 428 icf.exe 3836 icf.exe 4312 icf.exe 4760 icf.exe 4100 icf.exe 2456 icf.exe 2600 icf.exe 2192 icf.exe 4472 icf.exe 4828 icf.exe 3940 icf.exe 372 icf.exe 2564 icf.exe 2592 icf.exe 1300 icf.exe 624 icf.exe 3188 icf.exe 2852 icf.exe 3512 icf.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "C:\\Windows\\system32\\icf.exe" Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe icf.exe File created C:\Windows\SysWOW64\icf.exe Process not Found File created C:\Windows\SysWOW64\icf.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4688 wrote to memory of 3408 4688 f57ba037a62c2fd6a1c73f5c194a9731_JaffaCakes118.exe 82 PID 4688 wrote to memory of 3408 4688 f57ba037a62c2fd6a1c73f5c194a9731_JaffaCakes118.exe 82 PID 4688 wrote to memory of 3408 4688 f57ba037a62c2fd6a1c73f5c194a9731_JaffaCakes118.exe 82 PID 3408 wrote to memory of 448 3408 icf.exe 83 PID 3408 wrote to memory of 448 3408 icf.exe 83 PID 3408 wrote to memory of 448 3408 icf.exe 83 PID 448 wrote to memory of 532 448 icf.exe 84 PID 448 wrote to memory of 532 448 icf.exe 84 PID 448 wrote to memory of 532 448 icf.exe 84 PID 532 wrote to memory of 4876 532 icf.exe 85 PID 532 wrote to memory of 4876 532 icf.exe 85 PID 532 wrote to memory of 4876 532 icf.exe 85 PID 4876 wrote to memory of 4348 4876 icf.exe 86 PID 4876 wrote to memory of 4348 4876 icf.exe 86 PID 4876 wrote to memory of 4348 4876 icf.exe 86 PID 4348 wrote to memory of 5012 4348 icf.exe 87 PID 4348 wrote to memory of 5012 4348 icf.exe 87 PID 4348 wrote to memory of 5012 4348 icf.exe 87 PID 5012 wrote to memory of 3888 5012 icf.exe 88 PID 5012 wrote to memory of 3888 5012 icf.exe 88 PID 5012 wrote to memory of 3888 5012 icf.exe 88 PID 3888 wrote to memory of 1312 3888 icf.exe 89 PID 3888 wrote to memory of 1312 3888 icf.exe 89 PID 3888 wrote to memory of 1312 3888 icf.exe 89 PID 1312 wrote to memory of 1384 1312 icf.exe 90 PID 1312 wrote to memory of 1384 1312 icf.exe 90 PID 1312 wrote to memory of 1384 1312 icf.exe 90 PID 1384 wrote to memory of 1464 1384 icf.exe 91 PID 1384 wrote to memory of 1464 1384 icf.exe 91 PID 1384 wrote to memory of 1464 1384 icf.exe 91 PID 1464 wrote to memory of 660 1464 icf.exe 92 PID 1464 wrote to memory of 660 1464 icf.exe 92 PID 1464 wrote to memory of 660 1464 icf.exe 92 PID 660 wrote to memory of 3492 660 icf.exe 93 PID 660 wrote to memory of 3492 660 icf.exe 93 PID 660 wrote to memory of 3492 660 icf.exe 93 PID 3492 wrote to memory of 4196 3492 icf.exe 94 PID 3492 wrote to memory of 4196 3492 icf.exe 94 PID 3492 wrote to memory of 4196 3492 icf.exe 94 PID 4196 wrote to memory of 4856 4196 icf.exe 95 PID 4196 wrote to memory of 4856 4196 icf.exe 95 PID 4196 wrote to memory of 4856 4196 icf.exe 95 PID 4856 wrote to memory of 2944 4856 icf.exe 96 PID 4856 wrote to memory of 2944 4856 icf.exe 96 PID 4856 wrote to memory of 2944 4856 icf.exe 96 PID 2944 wrote to memory of 3664 2944 icf.exe 97 PID 2944 wrote to memory of 3664 2944 icf.exe 97 PID 2944 wrote to memory of 3664 2944 icf.exe 97 PID 3664 wrote to memory of 912 3664 icf.exe 98 PID 3664 wrote to memory of 912 3664 icf.exe 98 PID 3664 wrote to memory of 912 3664 icf.exe 98 PID 912 wrote to memory of 424 912 icf.exe 99 PID 912 wrote to memory of 424 912 icf.exe 99 PID 912 wrote to memory of 424 912 icf.exe 99 PID 424 wrote to memory of 1972 424 icf.exe 100 PID 424 wrote to memory of 1972 424 icf.exe 100 PID 424 wrote to memory of 1972 424 icf.exe 100 PID 1972 wrote to memory of 1984 1972 icf.exe 101 PID 1972 wrote to memory of 1984 1972 icf.exe 101 PID 1972 wrote to memory of 1984 1972 icf.exe 101 PID 1984 wrote to memory of 2968 1984 icf.exe 102 PID 1984 wrote to memory of 2968 1984 icf.exe 102 PID 1984 wrote to memory of 2968 1984 icf.exe 102 PID 2968 wrote to memory of 436 2968 icf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f57ba037a62c2fd6a1c73f5c194a9731_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f57ba037a62c2fd6a1c73f5c194a9731_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe11⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe23⤵
- Executes dropped EXE
PID:436 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe24⤵
- Executes dropped EXE
PID:3720 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe25⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe26⤵
- Executes dropped EXE
PID:4056 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe27⤵
- Executes dropped EXE
PID:3120 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe28⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe29⤵
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe30⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe31⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe32⤵
- Executes dropped EXE
PID:5084 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe33⤵
- Executes dropped EXE
PID:5036 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe34⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe35⤵
- Executes dropped EXE
PID:2240 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe36⤵
- Executes dropped EXE
PID:4404 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe37⤵
- Executes dropped EXE
PID:3160 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe38⤵
- Executes dropped EXE
PID:3640 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe39⤵
- Executes dropped EXE
PID:4744 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe40⤵
- Executes dropped EXE
PID:3320 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe41⤵
- Executes dropped EXE
PID:3312 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe42⤵
- Executes dropped EXE
PID:1308 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe43⤵
- Executes dropped EXE
PID:960 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe44⤵
- Executes dropped EXE
PID:4320 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe45⤵
- Executes dropped EXE
PID:3848 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe46⤵
- Executes dropped EXE
PID:3748 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe47⤵
- Executes dropped EXE
PID:428 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe48⤵
- Executes dropped EXE
PID:3836 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4312 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe50⤵
- Executes dropped EXE
PID:4760 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe51⤵
- Executes dropped EXE
PID:4100 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe52⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe53⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe54⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe55⤵
- Executes dropped EXE
PID:4472 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe56⤵
- Executes dropped EXE
PID:4828 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe57⤵
- Executes dropped EXE
PID:3940 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:372 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe59⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2564 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe60⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe61⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe62⤵
- Executes dropped EXE
PID:624 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe63⤵
- Executes dropped EXE
PID:3188 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe64⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe65⤵
- Executes dropped EXE
PID:3512 -
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe66⤵PID:2764
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe67⤵PID:2956
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe68⤵PID:3000
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe69⤵PID:3124
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe70⤵PID:1184
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe71⤵PID:4428
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe72⤵PID:1836
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe73⤵PID:2200
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe74⤵PID:2696
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe75⤵PID:1940
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe76⤵PID:3588
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe77⤵PID:3544
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe78⤵PID:1512
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe79⤵PID:3424
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe80⤵PID:5072
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe81⤵PID:2020
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe82⤵PID:4368
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe83⤵PID:4332
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe84⤵PID:2036
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe85⤵PID:2432
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe86⤵PID:5000
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe87⤵PID:548
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe88⤵PID:4800
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe89⤵PID:4656
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe90⤵PID:4392
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe91⤵PID:4532
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe92⤵PID:4616
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe93⤵PID:3136
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe94⤵PID:2568
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe95⤵PID:708
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe96⤵PID:4632
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe97⤵PID:936
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe98⤵PID:4436
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe99⤵PID:5096
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe100⤵PID:1336
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe101⤵PID:4704
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe102⤵PID:5012
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe103⤵PID:992
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe104⤵PID:1084
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe105⤵PID:2952
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe106⤵PID:2624
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe107⤵PID:2840
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe108⤵PID:2800
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe109⤵PID:1296
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe110⤵PID:4196
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe111⤵PID:3784
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe112⤵PID:2328
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe113⤵PID:1060
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe114⤵PID:1708
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe115⤵PID:4120
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe116⤵PID:732
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe117⤵PID:3348
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe118⤵PID:4204
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe119⤵PID:1984
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe120⤵PID:2968
-
C:\Windows\SysWOW64\icf.exeC:\Windows\system32\icf.exe121⤵PID:3704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-