Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe
-
Size
220KB
-
MD5
b493cf0fe1f93895aca6b6834edb62b0
-
SHA1
2af8f287ce851f3d11b1f0a5ca33f6bba1d612ca
-
SHA256
e7e37b61aac7b9e44c65493187584f285ef5986e2c44f7747663971f60d34b5c
-
SHA512
d4159d22f90cfbe7601a51edfb3411d2589c21f5cb4955270b3eb84878fb9bbf975ac0dac917a34865da13422979f53a54008cf5a26735b3368408145cdc254a
-
SSDEEP
6144:t1JIfielipuGOMlliO1DmWIgff9aGzde4qz:t1JKi8ciYq0fZzqz
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Deletes itself 1 IoCs
pid Process 2092 wmirpcf.exe -
Executes dropped EXE 64 IoCs
pid Process 1616 wmirpcf.exe 2092 wmirpcf.exe 3068 wmirpcf.exe 2904 wmirpcf.exe 2484 wmirpcf.exe 632 wmirpcf.exe 2776 wmirpcf.exe 1156 wmirpcf.exe 1900 wmirpcf.exe 1928 wmirpcf.exe 2024 wmirpcf.exe 2604 wmirpcf.exe 1100 wmirpcf.exe 2000 wmirpcf.exe 1648 wmirpcf.exe 2028 wmirpcf.exe 288 wmirpcf.exe 2056 wmirpcf.exe 1684 wmirpcf.exe 2008 wmirpcf.exe 1664 wmirpcf.exe 2400 wmirpcf.exe 3000 wmirpcf.exe 2336 wmirpcf.exe 2644 wmirpcf.exe 2980 wmirpcf.exe 2940 wmirpcf.exe 332 wmirpcf.exe 564 wmirpcf.exe 1304 wmirpcf.exe 2104 wmirpcf.exe 1612 wmirpcf.exe 2536 wmirpcf.exe 1496 wmirpcf.exe 1848 wmirpcf.exe 976 wmirpcf.exe 892 wmirpcf.exe 2268 wmirpcf.exe 864 wmirpcf.exe 1288 wmirpcf.exe 1588 wmirpcf.exe 824 wmirpcf.exe 1692 wmirpcf.exe 1664 wmirpcf.exe 2956 wmirpcf.exe 3000 wmirpcf.exe 2788 wmirpcf.exe 2752 wmirpcf.exe 2948 wmirpcf.exe 2944 wmirpcf.exe 708 wmirpcf.exe 1424 wmirpcf.exe 2512 wmirpcf.exe 540 wmirpcf.exe 2256 wmirpcf.exe 2100 wmirpcf.exe 2536 wmirpcf.exe 1364 wmirpcf.exe 2652 wmirpcf.exe 1624 wmirpcf.exe 1868 wmirpcf.exe 2596 wmirpcf.exe 1736 wmirpcf.exe 1940 wmirpcf.exe -
Loads dropped DLL 64 IoCs
pid Process 2080 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 2080 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 1616 wmirpcf.exe 2092 wmirpcf.exe 2092 wmirpcf.exe 2904 wmirpcf.exe 2904 wmirpcf.exe 632 wmirpcf.exe 632 wmirpcf.exe 1156 wmirpcf.exe 1156 wmirpcf.exe 1928 wmirpcf.exe 1928 wmirpcf.exe 2604 wmirpcf.exe 2604 wmirpcf.exe 2000 wmirpcf.exe 2000 wmirpcf.exe 2028 wmirpcf.exe 2028 wmirpcf.exe 2056 wmirpcf.exe 2056 wmirpcf.exe 2008 wmirpcf.exe 2008 wmirpcf.exe 2400 wmirpcf.exe 2400 wmirpcf.exe 2336 wmirpcf.exe 2336 wmirpcf.exe 2980 wmirpcf.exe 2980 wmirpcf.exe 332 wmirpcf.exe 332 wmirpcf.exe 1304 wmirpcf.exe 1304 wmirpcf.exe 1612 wmirpcf.exe 1612 wmirpcf.exe 1496 wmirpcf.exe 1496 wmirpcf.exe 976 wmirpcf.exe 976 wmirpcf.exe 2268 wmirpcf.exe 2268 wmirpcf.exe 1288 wmirpcf.exe 1288 wmirpcf.exe 824 wmirpcf.exe 824 wmirpcf.exe 1664 wmirpcf.exe 1664 wmirpcf.exe 3000 wmirpcf.exe 3000 wmirpcf.exe 2752 wmirpcf.exe 2752 wmirpcf.exe 2944 wmirpcf.exe 2944 wmirpcf.exe 1424 wmirpcf.exe 1424 wmirpcf.exe 540 wmirpcf.exe 540 wmirpcf.exe 2100 wmirpcf.exe 2100 wmirpcf.exe 1364 wmirpcf.exe 1364 wmirpcf.exe 1624 wmirpcf.exe 1624 wmirpcf.exe 2596 wmirpcf.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File created C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe File opened for modification C:\Windows\SysWOW64\wmirpcf.exe wmirpcf.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 2648 set thread context of 2080 2648 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 30 PID 1616 set thread context of 2092 1616 wmirpcf.exe 32 PID 3068 set thread context of 2904 3068 wmirpcf.exe 34 PID 2484 set thread context of 632 2484 wmirpcf.exe 36 PID 2776 set thread context of 1156 2776 wmirpcf.exe 38 PID 1900 set thread context of 1928 1900 wmirpcf.exe 40 PID 2024 set thread context of 2604 2024 wmirpcf.exe 42 PID 1100 set thread context of 2000 1100 wmirpcf.exe 44 PID 1648 set thread context of 2028 1648 wmirpcf.exe 46 PID 288 set thread context of 2056 288 wmirpcf.exe 49 PID 1684 set thread context of 2008 1684 wmirpcf.exe 51 PID 1664 set thread context of 2400 1664 wmirpcf.exe 53 PID 3000 set thread context of 2336 3000 wmirpcf.exe 55 PID 2644 set thread context of 2980 2644 wmirpcf.exe 57 PID 2940 set thread context of 332 2940 wmirpcf.exe 59 PID 564 set thread context of 1304 564 wmirpcf.exe 61 PID 2104 set thread context of 1612 2104 wmirpcf.exe 63 PID 2536 set thread context of 1496 2536 wmirpcf.exe 65 PID 1848 set thread context of 976 1848 wmirpcf.exe 67 PID 892 set thread context of 2268 892 wmirpcf.exe 69 PID 864 set thread context of 1288 864 wmirpcf.exe 71 PID 1588 set thread context of 824 1588 wmirpcf.exe 73 PID 1692 set thread context of 1664 1692 wmirpcf.exe 75 PID 2956 set thread context of 3000 2956 wmirpcf.exe 77 PID 2788 set thread context of 2752 2788 wmirpcf.exe 79 PID 2948 set thread context of 2944 2948 wmirpcf.exe 81 PID 708 set thread context of 1424 708 wmirpcf.exe 83 PID 2512 set thread context of 540 2512 wmirpcf.exe 85 PID 2256 set thread context of 2100 2256 wmirpcf.exe 87 PID 2536 set thread context of 1364 2536 wmirpcf.exe 89 PID 2652 set thread context of 1624 2652 wmirpcf.exe 91 PID 1868 set thread context of 2596 1868 wmirpcf.exe 93 PID 1736 set thread context of 1940 1736 wmirpcf.exe 95 PID 1320 set thread context of 2436 1320 wmirpcf.exe 97 PID 2960 set thread context of 2460 2960 wmirpcf.exe 99 PID 2708 set thread context of 2688 2708 wmirpcf.exe 101 PID 2696 set thread context of 2860 2696 wmirpcf.exe 103 PID 1696 set thread context of 484 1696 wmirpcf.exe 105 PID 580 set thread context of 2524 580 wmirpcf.exe 107 PID 276 set thread context of 2256 276 wmirpcf.exe 109 PID 2112 set thread context of 952 2112 wmirpcf.exe 111 PID 2928 set thread context of 2444 2928 wmirpcf.exe 113 PID 1112 set thread context of 288 1112 wmirpcf.exe 115 PID 2648 set thread context of 300 2648 wmirpcf.exe 117 PID 2816 set thread context of 1672 2816 wmirpcf.exe 119 PID 2700 set thread context of 2824 2700 wmirpcf.exe 121 PID 2692 set thread context of 2424 2692 wmirpcf.exe 123 PID 588 set thread context of 2948 588 wmirpcf.exe 125 PID 1296 set thread context of 2760 1296 wmirpcf.exe 127 PID 2104 set thread context of 1936 2104 wmirpcf.exe 129 PID 408 set thread context of 832 408 wmirpcf.exe 131 PID 828 set thread context of 1668 828 wmirpcf.exe 133 PID 2928 set thread context of 948 2928 wmirpcf.exe 135 PID 2168 set thread context of 1628 2168 wmirpcf.exe 137 PID 2300 set thread context of 1180 2300 wmirpcf.exe 139 PID 2332 set thread context of 1952 2332 wmirpcf.exe 141 PID 2804 set thread context of 2732 2804 wmirpcf.exe 143 PID 3032 set thread context of 1552 3032 wmirpcf.exe 145 PID 2764 set thread context of 1484 2764 wmirpcf.exe 147 PID 3020 set thread context of 848 3020 wmirpcf.exe 149 PID 2480 set thread context of 2640 2480 wmirpcf.exe 151 PID 1560 set thread context of 276 1560 wmirpcf.exe 153 PID 2564 set thread context of 2112 2564 wmirpcf.exe 155 PID 304 set thread context of 688 304 wmirpcf.exe 157 -
resource yara_rule behavioral1/memory/2080-5-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2080-19-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2080-18-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2080-17-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2080-16-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2080-11-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2080-9-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2080-32-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2092-50-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2092-49-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2092-48-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2092-47-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2092-56-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2904-72-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2904-78-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/632-92-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/632-100-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1156-114-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1156-123-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1928-139-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1928-146-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2604-161-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2604-168-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2000-184-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2000-190-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2028-206-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2028-215-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2056-234-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2008-248-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2008-256-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2400-278-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2336-299-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2980-320-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/332-337-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1304-354-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1612-371-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1496-388-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/976-405-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2268-422-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1288-439-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/824-456-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1664-473-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/3000-490-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2752-507-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2944-524-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1424-541-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/540-553-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/540-559-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2100-576-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1364-593-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1624-610-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2596-627-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1940-644-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2436-661-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2460-678-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2688-695-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2860-712-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/484-729-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2524-746-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2256-763-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/952-780-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2444-797-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/288-814-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/300-831-0x0000000000400000-0x0000000000460000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmirpcf.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command wmirpcf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2080 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 2092 wmirpcf.exe 2904 wmirpcf.exe 632 wmirpcf.exe 1156 wmirpcf.exe 1928 wmirpcf.exe 2604 wmirpcf.exe 2000 wmirpcf.exe 2028 wmirpcf.exe 2056 wmirpcf.exe 2008 wmirpcf.exe 2400 wmirpcf.exe 2336 wmirpcf.exe 2980 wmirpcf.exe 332 wmirpcf.exe 1304 wmirpcf.exe 1612 wmirpcf.exe 1496 wmirpcf.exe 976 wmirpcf.exe 2268 wmirpcf.exe 1288 wmirpcf.exe 824 wmirpcf.exe 1664 wmirpcf.exe 3000 wmirpcf.exe 2752 wmirpcf.exe 2944 wmirpcf.exe 1424 wmirpcf.exe 540 wmirpcf.exe 2100 wmirpcf.exe 1364 wmirpcf.exe 1624 wmirpcf.exe 2596 wmirpcf.exe 1940 wmirpcf.exe 2436 wmirpcf.exe 2460 wmirpcf.exe 2688 wmirpcf.exe 2860 wmirpcf.exe 484 wmirpcf.exe 2524 wmirpcf.exe 2256 wmirpcf.exe 952 wmirpcf.exe 2444 wmirpcf.exe 288 wmirpcf.exe 300 wmirpcf.exe 1672 wmirpcf.exe 2824 wmirpcf.exe 2424 wmirpcf.exe 2948 wmirpcf.exe 2760 wmirpcf.exe 1936 wmirpcf.exe 832 wmirpcf.exe 1668 wmirpcf.exe 948 wmirpcf.exe 1628 wmirpcf.exe 1180 wmirpcf.exe 1952 wmirpcf.exe 2732 wmirpcf.exe 1552 wmirpcf.exe 1484 wmirpcf.exe 848 wmirpcf.exe 2640 wmirpcf.exe 276 wmirpcf.exe 2112 wmirpcf.exe 688 wmirpcf.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2648 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 1616 wmirpcf.exe 3068 wmirpcf.exe 2484 wmirpcf.exe 2776 wmirpcf.exe 1900 wmirpcf.exe 2024 wmirpcf.exe 1100 wmirpcf.exe 1648 wmirpcf.exe 288 wmirpcf.exe 1684 wmirpcf.exe 1664 wmirpcf.exe 3000 wmirpcf.exe 2644 wmirpcf.exe 2940 wmirpcf.exe 564 wmirpcf.exe 2104 wmirpcf.exe 2536 wmirpcf.exe 1848 wmirpcf.exe 892 wmirpcf.exe 864 wmirpcf.exe 1588 wmirpcf.exe 1692 wmirpcf.exe 2956 wmirpcf.exe 2788 wmirpcf.exe 2948 wmirpcf.exe 708 wmirpcf.exe 2512 wmirpcf.exe 2256 wmirpcf.exe 2536 wmirpcf.exe 2652 wmirpcf.exe 1868 wmirpcf.exe 1736 wmirpcf.exe 1320 wmirpcf.exe 2960 wmirpcf.exe 2708 wmirpcf.exe 2696 wmirpcf.exe 1696 wmirpcf.exe 580 wmirpcf.exe 276 wmirpcf.exe 2112 wmirpcf.exe 2928 wmirpcf.exe 1112 wmirpcf.exe 2648 wmirpcf.exe 2816 wmirpcf.exe 2700 wmirpcf.exe 2692 wmirpcf.exe 588 wmirpcf.exe 1296 wmirpcf.exe 2104 wmirpcf.exe 408 wmirpcf.exe 828 wmirpcf.exe 2928 wmirpcf.exe 2168 wmirpcf.exe 2300 wmirpcf.exe 2332 wmirpcf.exe 2804 wmirpcf.exe 3032 wmirpcf.exe 2764 wmirpcf.exe 3020 wmirpcf.exe 2480 wmirpcf.exe 1560 wmirpcf.exe 2564 wmirpcf.exe 304 wmirpcf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2080 2648 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2080 2648 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2080 2648 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2080 2648 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2080 2648 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2080 2648 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2080 2648 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2080 2648 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 30 PID 2080 wrote to memory of 1616 2080 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 31 PID 2080 wrote to memory of 1616 2080 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 31 PID 2080 wrote to memory of 1616 2080 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 31 PID 2080 wrote to memory of 1616 2080 b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe 31 PID 1616 wrote to memory of 2092 1616 wmirpcf.exe 32 PID 1616 wrote to memory of 2092 1616 wmirpcf.exe 32 PID 1616 wrote to memory of 2092 1616 wmirpcf.exe 32 PID 1616 wrote to memory of 2092 1616 wmirpcf.exe 32 PID 1616 wrote to memory of 2092 1616 wmirpcf.exe 32 PID 1616 wrote to memory of 2092 1616 wmirpcf.exe 32 PID 1616 wrote to memory of 2092 1616 wmirpcf.exe 32 PID 1616 wrote to memory of 2092 1616 wmirpcf.exe 32 PID 2092 wrote to memory of 3068 2092 wmirpcf.exe 33 PID 2092 wrote to memory of 3068 2092 wmirpcf.exe 33 PID 2092 wrote to memory of 3068 2092 wmirpcf.exe 33 PID 2092 wrote to memory of 3068 2092 wmirpcf.exe 33 PID 3068 wrote to memory of 2904 3068 wmirpcf.exe 34 PID 3068 wrote to memory of 2904 3068 wmirpcf.exe 34 PID 3068 wrote to memory of 2904 3068 wmirpcf.exe 34 PID 3068 wrote to memory of 2904 3068 wmirpcf.exe 34 PID 3068 wrote to memory of 2904 3068 wmirpcf.exe 34 PID 3068 wrote to memory of 2904 3068 wmirpcf.exe 34 PID 3068 wrote to memory of 2904 3068 wmirpcf.exe 34 PID 3068 wrote to memory of 2904 3068 wmirpcf.exe 34 PID 2904 wrote to memory of 2484 2904 wmirpcf.exe 35 PID 2904 wrote to memory of 2484 2904 wmirpcf.exe 35 PID 2904 wrote to memory of 2484 2904 wmirpcf.exe 35 PID 2904 wrote to memory of 2484 2904 wmirpcf.exe 35 PID 2484 wrote to memory of 632 2484 wmirpcf.exe 36 PID 2484 wrote to memory of 632 2484 wmirpcf.exe 36 PID 2484 wrote to memory of 632 2484 wmirpcf.exe 36 PID 2484 wrote to memory of 632 2484 wmirpcf.exe 36 PID 2484 wrote to memory of 632 2484 wmirpcf.exe 36 PID 2484 wrote to memory of 632 2484 wmirpcf.exe 36 PID 2484 wrote to memory of 632 2484 wmirpcf.exe 36 PID 2484 wrote to memory of 632 2484 wmirpcf.exe 36 PID 632 wrote to memory of 2776 632 wmirpcf.exe 37 PID 632 wrote to memory of 2776 632 wmirpcf.exe 37 PID 632 wrote to memory of 2776 632 wmirpcf.exe 37 PID 632 wrote to memory of 2776 632 wmirpcf.exe 37 PID 2776 wrote to memory of 1156 2776 wmirpcf.exe 38 PID 2776 wrote to memory of 1156 2776 wmirpcf.exe 38 PID 2776 wrote to memory of 1156 2776 wmirpcf.exe 38 PID 2776 wrote to memory of 1156 2776 wmirpcf.exe 38 PID 2776 wrote to memory of 1156 2776 wmirpcf.exe 38 PID 2776 wrote to memory of 1156 2776 wmirpcf.exe 38 PID 2776 wrote to memory of 1156 2776 wmirpcf.exe 38 PID 2776 wrote to memory of 1156 2776 wmirpcf.exe 38 PID 1156 wrote to memory of 1900 1156 wmirpcf.exe 39 PID 1156 wrote to memory of 1900 1156 wmirpcf.exe 39 PID 1156 wrote to memory of 1900 1156 wmirpcf.exe 39 PID 1156 wrote to memory of 1900 1156 wmirpcf.exe 39 PID 1900 wrote to memory of 1928 1900 wmirpcf.exe 40 PID 1900 wrote to memory of 1928 1900 wmirpcf.exe 40 PID 1900 wrote to memory of 1928 1900 wmirpcf.exe 40 PID 1900 wrote to memory of 1928 1900 wmirpcf.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b493cf0fe1f93895aca6b6834edb62b0_JaffaCakes118.exe2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Users\Admin\AppData\Local\Temp\B493CF~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Users\Admin\AppData\Local\Temp\B493CF~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1928 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2024 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2604 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1100 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2000 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2028 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:288 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2056 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1684 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2008 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1664 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2400 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3000 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2336 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2644 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2980 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2940 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:332 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:564 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1304 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2104 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe34⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1612 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2536 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe36⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1496 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1848 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe38⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:976 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:892 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe40⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2268 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:864 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe42⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1288 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1588 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe44⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:824 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1692 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe46⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1664 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2956 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe48⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3000 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2788 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe50⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2752 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2948 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe52⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2944 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:708 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe54⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1424 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2512 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe56⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:540 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2256 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe58⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2100 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2536 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe60⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1364 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2652 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe62⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1624 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1868 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe64⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2596 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1736 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe66⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1940 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe67⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1320 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe68⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2436 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe69⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2960 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe70⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2460 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe71⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2708 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe72⤵
- Suspicious behavior: EnumeratesProcesses
PID:2688 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe73⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2696 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe74⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2860 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe75⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1696 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe76⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:484 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe77⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:580 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe78⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2524 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe79⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:276 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe80⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2256 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe81⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2112 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe82⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:952 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe83⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2928 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe84⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2444 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe85⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1112 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe86⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:288 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe87⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2648 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe88⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:300 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe89⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2816 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe90⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1672 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe91⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2700 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe92⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2824 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe93⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2692 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe94⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2424 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe95⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:588 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe96⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2948 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe97⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1296 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe98⤵
- Suspicious behavior: EnumeratesProcesses
PID:2760 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe99⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2104 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe100⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1936 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe101⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:408 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe102⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:832 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe103⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:828 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe104⤵
- Suspicious behavior: EnumeratesProcesses
PID:1668 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe105⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2928 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe106⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:948 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe107⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2168 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe108⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1628 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe109⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2300 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe110⤵
- Suspicious behavior: EnumeratesProcesses
PID:1180 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe111⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2332 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe112⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1952 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe113⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2804 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe114⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2732 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe115⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3032 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe116⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1552 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe117⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2764 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe118⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1484 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe119⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3020 -
C:\Windows\SysWOW64\wmirpcf.exeC:\Windows\SysWOW64\wmirpcf.exe C:\Windows\SysWOW64\wmirpcf.exe120⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:848 -
C:\Windows\SysWOW64\wmirpcf.exe"C:\Windows\system32\wmirpcf.exe" C:\Windows\SysWOW64\wmirpcf.exe121⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-