Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
c0e5c2b62d47728b11de9bbd9411f287.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c0e5c2b62d47728b11de9bbd9411f287.exe
Resource
win10v2004-20240226-en
General
-
Target
c0e5c2b62d47728b11de9bbd9411f287.exe
-
Size
232KB
-
MD5
c0e5c2b62d47728b11de9bbd9411f287
-
SHA1
a95e8de5f747018729f10bd29c8105382952d8da
-
SHA256
8c0b64250cc45b6355e000c19f84277ed36c82db1ee2a7a0b1b7b61715f637c8
-
SHA512
f87ea7ece09df6d2652cd566fbeb3b37d8277e8edd0d1ec8a5cfbd969261105447a95ea874a1a0b167539b445f6964edb4bacd70b8b5caa46134f12333aa68a7
-
SSDEEP
3072:iS9RUUb0IYRCN5PJRayrDQJzYqr0zJDITKbhduOToZlpK0IMgmVEx+hRF4q5ETF:TblYR2TwyX4YqrUIOXYnWM9Kqgq5E
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation c0e5c2b62d47728b11de9bbd9411f287.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation wmispqd.exe -
Deletes itself 1 IoCs
pid Process 4828 wmispqd.exe -
Executes dropped EXE 64 IoCs
pid Process 4548 wmispqd.exe 4828 wmispqd.exe 832 wmispqd.exe 1976 wmispqd.exe 3028 wmispqd.exe 5092 wmispqd.exe 4180 wmispqd.exe 2204 wmispqd.exe 2056 wmispqd.exe 4348 wmispqd.exe 4364 wmispqd.exe 3936 wmispqd.exe 4124 wmispqd.exe 4776 wmispqd.exe 3176 wmispqd.exe 1932 wmispqd.exe 1052 wmispqd.exe 2004 wmispqd.exe 3100 wmispqd.exe 2212 wmispqd.exe 4180 wmispqd.exe 3168 wmispqd.exe 4100 wmispqd.exe 1376 wmispqd.exe 584 wmispqd.exe 4468 wmispqd.exe 388 wmispqd.exe 1224 wmispqd.exe 4736 wmispqd.exe 1684 wmispqd.exe 4420 wmispqd.exe 3140 wmispqd.exe 872 wmispqd.exe 1652 wmispqd.exe 2176 wmispqd.exe 4976 wmispqd.exe 2592 wmispqd.exe 528 wmispqd.exe 4324 wmispqd.exe 5008 wmispqd.exe 3484 wmispqd.exe 5004 wmispqd.exe 3864 wmispqd.exe 2968 wmispqd.exe 3720 wmispqd.exe 4688 wmispqd.exe 4796 wmispqd.exe 2008 wmispqd.exe 2548 wmispqd.exe 4736 wmispqd.exe 3556 wmispqd.exe 3132 wmispqd.exe 4296 wmispqd.exe 3780 wmispqd.exe 2464 wmispqd.exe 3552 wmispqd.exe 2508 wmispqd.exe 4960 wmispqd.exe 4904 wmispqd.exe 1552 wmispqd.exe 4020 wmispqd.exe 3872 wmispqd.exe 5052 wmispqd.exe 216 wmispqd.exe -
resource yara_rule behavioral2/memory/3704-4-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3704-3-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3704-5-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3704-8-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3704-10-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3704-9-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3704-11-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3704-72-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4828-84-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4828-87-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4828-86-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4828-88-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4828-85-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4828-90-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1976-102-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1976-104-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1976-105-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1976-103-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1976-106-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1976-107-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5092-122-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5092-123-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2204-136-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2204-138-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2204-139-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2204-137-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2204-140-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2204-142-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4348-153-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4348-155-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4348-154-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4348-156-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4348-157-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4348-160-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3936-174-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3936-178-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4776-190-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4776-192-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4776-197-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1932-209-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1932-215-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2004-224-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2004-227-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2004-233-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2212-244-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2212-249-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3168-260-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3168-262-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3168-266-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1376-277-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1376-278-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1376-281-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1376-285-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4468-296-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4468-299-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4468-305-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1224-314-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1224-317-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1224-323-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1684-334-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1684-339-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3140-349-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3140-352-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3140-358-0x0000000000400000-0x0000000000460000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe c0e5c2b62d47728b11de9bbd9411f287.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File created C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe File opened for modification C:\Windows\SysWOW64\wmispqd.exe wmispqd.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 1020 set thread context of 3704 1020 c0e5c2b62d47728b11de9bbd9411f287.exe 87 PID 4548 set thread context of 4828 4548 wmispqd.exe 92 PID 832 set thread context of 1976 832 wmispqd.exe 94 PID 3028 set thread context of 5092 3028 wmispqd.exe 98 PID 4180 set thread context of 2204 4180 wmispqd.exe 102 PID 2056 set thread context of 4348 2056 wmispqd.exe 105 PID 4364 set thread context of 3936 4364 wmispqd.exe 107 PID 4124 set thread context of 4776 4124 wmispqd.exe 110 PID 3176 set thread context of 1932 3176 wmispqd.exe 112 PID 1052 set thread context of 2004 1052 wmispqd.exe 115 PID 3100 set thread context of 2212 3100 wmispqd.exe 117 PID 4180 set thread context of 3168 4180 wmispqd.exe 119 PID 4100 set thread context of 1376 4100 wmispqd.exe 122 PID 584 set thread context of 4468 584 wmispqd.exe 124 PID 388 set thread context of 1224 388 wmispqd.exe 126 PID 4736 set thread context of 1684 4736 wmispqd.exe 128 PID 4420 set thread context of 3140 4420 wmispqd.exe 130 PID 872 set thread context of 1652 872 wmispqd.exe 132 PID 2176 set thread context of 4976 2176 wmispqd.exe 135 PID 2592 set thread context of 528 2592 wmispqd.exe 137 PID 4324 set thread context of 5008 4324 wmispqd.exe 140 PID 3484 set thread context of 5004 3484 wmispqd.exe 142 PID 3864 set thread context of 2968 3864 wmispqd.exe 144 PID 3720 set thread context of 4688 3720 wmispqd.exe 146 PID 4796 set thread context of 2008 4796 wmispqd.exe 148 PID 2548 set thread context of 4736 2548 wmispqd.exe 150 PID 3556 set thread context of 3132 3556 wmispqd.exe 152 PID 4296 set thread context of 3780 4296 wmispqd.exe 154 PID 2464 set thread context of 3552 2464 wmispqd.exe 156 PID 2508 set thread context of 4960 2508 wmispqd.exe 158 PID 4904 set thread context of 1552 4904 wmispqd.exe 160 PID 4020 set thread context of 3872 4020 wmispqd.exe 162 PID 5052 set thread context of 216 5052 wmispqd.exe 164 PID 720 set thread context of 532 720 wmispqd.exe 166 PID 640 set thread context of 4728 640 wmispqd.exe 168 PID 3448 set thread context of 4992 3448 wmispqd.exe 170 PID 3676 set thread context of 2548 3676 wmispqd.exe 172 PID 4884 set thread context of 3688 4884 wmispqd.exe 174 PID 3968 set thread context of 836 3968 wmispqd.exe 177 PID 1316 set thread context of 792 1316 wmispqd.exe 179 PID 3368 set thread context of 2576 3368 wmispqd.exe 181 PID 4612 set thread context of 2196 4612 wmispqd.exe 183 PID 3376 set thread context of 4432 3376 wmispqd.exe 185 PID 4116 set thread context of 3968 4116 wmispqd.exe 187 PID 1908 set thread context of 3244 1908 wmispqd.exe 189 PID 2796 set thread context of 3516 2796 wmispqd.exe 191 PID 2936 set thread context of 4020 2936 wmispqd.exe 193 PID 3256 set thread context of 5104 3256 wmispqd.exe 195 PID 3508 set thread context of 1944 3508 wmispqd.exe 197 PID 3892 set thread context of 5044 3892 wmispqd.exe 199 PID 1900 set thread context of 4244 1900 wmispqd.exe 201 PID 1908 set thread context of 3500 1908 wmispqd.exe 203 PID 4180 set thread context of 1728 4180 wmispqd.exe 205 PID 4904 set thread context of 3604 4904 wmispqd.exe 207 PID 2096 set thread context of 3896 2096 wmispqd.exe 209 PID 3792 set thread context of 1744 3792 wmispqd.exe 211 PID 2032 set thread context of 3236 2032 wmispqd.exe 213 PID 2460 set thread context of 4900 2460 wmispqd.exe 217 PID 1064 set thread context of 3632 1064 wmispqd.exe 221 PID 4752 set thread context of 3716 4752 wmispqd.exe 223 PID 3880 set thread context of 680 3880 wmispqd.exe 225 PID 456 set thread context of 452 456 wmispqd.exe 227 PID 4292 set thread context of 1572 4292 wmispqd.exe 232 PID 2096 set thread context of 4108 2096 wmispqd.exe 234 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c0e5c2b62d47728b11de9bbd9411f287.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmispqd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3704 c0e5c2b62d47728b11de9bbd9411f287.exe 3704 c0e5c2b62d47728b11de9bbd9411f287.exe 4828 wmispqd.exe 4828 wmispqd.exe 1976 wmispqd.exe 1976 wmispqd.exe 5092 wmispqd.exe 5092 wmispqd.exe 2204 wmispqd.exe 2204 wmispqd.exe 4348 wmispqd.exe 4348 wmispqd.exe 3936 wmispqd.exe 3936 wmispqd.exe 4776 wmispqd.exe 4776 wmispqd.exe 1932 wmispqd.exe 1932 wmispqd.exe 2004 wmispqd.exe 2004 wmispqd.exe 2212 wmispqd.exe 2212 wmispqd.exe 3168 wmispqd.exe 3168 wmispqd.exe 1376 wmispqd.exe 1376 wmispqd.exe 4468 wmispqd.exe 4468 wmispqd.exe 1224 wmispqd.exe 1224 wmispqd.exe 1684 wmispqd.exe 1684 wmispqd.exe 3140 wmispqd.exe 3140 wmispqd.exe 1652 wmispqd.exe 1652 wmispqd.exe 4976 wmispqd.exe 4976 wmispqd.exe 528 wmispqd.exe 528 wmispqd.exe 5008 wmispqd.exe 5008 wmispqd.exe 5004 wmispqd.exe 5004 wmispqd.exe 2968 wmispqd.exe 2968 wmispqd.exe 4688 wmispqd.exe 4688 wmispqd.exe 2008 wmispqd.exe 2008 wmispqd.exe 4736 wmispqd.exe 4736 wmispqd.exe 3132 wmispqd.exe 3132 wmispqd.exe 3780 wmispqd.exe 3780 wmispqd.exe 3552 wmispqd.exe 3552 wmispqd.exe 4960 wmispqd.exe 4960 wmispqd.exe 1552 wmispqd.exe 1552 wmispqd.exe 3872 wmispqd.exe 3872 wmispqd.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1020 c0e5c2b62d47728b11de9bbd9411f287.exe 4548 wmispqd.exe 832 wmispqd.exe 3028 wmispqd.exe 4180 wmispqd.exe 2056 wmispqd.exe 4364 wmispqd.exe 4124 wmispqd.exe 3176 wmispqd.exe 1052 wmispqd.exe 3100 wmispqd.exe 4180 wmispqd.exe 4100 wmispqd.exe 584 wmispqd.exe 388 wmispqd.exe 4736 wmispqd.exe 4420 wmispqd.exe 872 wmispqd.exe 2176 wmispqd.exe 2592 wmispqd.exe 4324 wmispqd.exe 3484 wmispqd.exe 3864 wmispqd.exe 3720 wmispqd.exe 4796 wmispqd.exe 2548 wmispqd.exe 3556 wmispqd.exe 4296 wmispqd.exe 2464 wmispqd.exe 2508 wmispqd.exe 4904 wmispqd.exe 4020 wmispqd.exe 5052 wmispqd.exe 720 wmispqd.exe 640 wmispqd.exe 3448 wmispqd.exe 3676 wmispqd.exe 4884 wmispqd.exe 3968 wmispqd.exe 1316 wmispqd.exe 3368 wmispqd.exe 4612 wmispqd.exe 3376 wmispqd.exe 4116 wmispqd.exe 1908 wmispqd.exe 2796 wmispqd.exe 2936 wmispqd.exe 3256 wmispqd.exe 3508 wmispqd.exe 3892 wmispqd.exe 1900 wmispqd.exe 1908 wmispqd.exe 4180 wmispqd.exe 4904 wmispqd.exe 2096 wmispqd.exe 3792 wmispqd.exe 2032 wmispqd.exe 2460 wmispqd.exe 1064 wmispqd.exe 4752 wmispqd.exe 3880 wmispqd.exe 456 wmispqd.exe 4292 wmispqd.exe 2096 wmispqd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1020 wrote to memory of 3704 1020 c0e5c2b62d47728b11de9bbd9411f287.exe 87 PID 1020 wrote to memory of 3704 1020 c0e5c2b62d47728b11de9bbd9411f287.exe 87 PID 1020 wrote to memory of 3704 1020 c0e5c2b62d47728b11de9bbd9411f287.exe 87 PID 1020 wrote to memory of 3704 1020 c0e5c2b62d47728b11de9bbd9411f287.exe 87 PID 1020 wrote to memory of 3704 1020 c0e5c2b62d47728b11de9bbd9411f287.exe 87 PID 1020 wrote to memory of 3704 1020 c0e5c2b62d47728b11de9bbd9411f287.exe 87 PID 1020 wrote to memory of 3704 1020 c0e5c2b62d47728b11de9bbd9411f287.exe 87 PID 3704 wrote to memory of 4548 3704 c0e5c2b62d47728b11de9bbd9411f287.exe 91 PID 3704 wrote to memory of 4548 3704 c0e5c2b62d47728b11de9bbd9411f287.exe 91 PID 3704 wrote to memory of 4548 3704 c0e5c2b62d47728b11de9bbd9411f287.exe 91 PID 4548 wrote to memory of 4828 4548 wmispqd.exe 92 PID 4548 wrote to memory of 4828 4548 wmispqd.exe 92 PID 4548 wrote to memory of 4828 4548 wmispqd.exe 92 PID 4548 wrote to memory of 4828 4548 wmispqd.exe 92 PID 4548 wrote to memory of 4828 4548 wmispqd.exe 92 PID 4548 wrote to memory of 4828 4548 wmispqd.exe 92 PID 4548 wrote to memory of 4828 4548 wmispqd.exe 92 PID 4828 wrote to memory of 832 4828 wmispqd.exe 93 PID 4828 wrote to memory of 832 4828 wmispqd.exe 93 PID 4828 wrote to memory of 832 4828 wmispqd.exe 93 PID 832 wrote to memory of 1976 832 wmispqd.exe 94 PID 832 wrote to memory of 1976 832 wmispqd.exe 94 PID 832 wrote to memory of 1976 832 wmispqd.exe 94 PID 832 wrote to memory of 1976 832 wmispqd.exe 94 PID 832 wrote to memory of 1976 832 wmispqd.exe 94 PID 832 wrote to memory of 1976 832 wmispqd.exe 94 PID 832 wrote to memory of 1976 832 wmispqd.exe 94 PID 1976 wrote to memory of 3028 1976 wmispqd.exe 97 PID 1976 wrote to memory of 3028 1976 wmispqd.exe 97 PID 1976 wrote to memory of 3028 1976 wmispqd.exe 97 PID 3028 wrote to memory of 5092 3028 wmispqd.exe 98 PID 3028 wrote to memory of 5092 3028 wmispqd.exe 98 PID 3028 wrote to memory of 5092 3028 wmispqd.exe 98 PID 3028 wrote to memory of 5092 3028 wmispqd.exe 98 PID 3028 wrote to memory of 5092 3028 wmispqd.exe 98 PID 3028 wrote to memory of 5092 3028 wmispqd.exe 98 PID 3028 wrote to memory of 5092 3028 wmispqd.exe 98 PID 5092 wrote to memory of 4180 5092 wmispqd.exe 101 PID 5092 wrote to memory of 4180 5092 wmispqd.exe 101 PID 5092 wrote to memory of 4180 5092 wmispqd.exe 101 PID 4180 wrote to memory of 2204 4180 wmispqd.exe 102 PID 4180 wrote to memory of 2204 4180 wmispqd.exe 102 PID 4180 wrote to memory of 2204 4180 wmispqd.exe 102 PID 4180 wrote to memory of 2204 4180 wmispqd.exe 102 PID 4180 wrote to memory of 2204 4180 wmispqd.exe 102 PID 4180 wrote to memory of 2204 4180 wmispqd.exe 102 PID 4180 wrote to memory of 2204 4180 wmispqd.exe 102 PID 2204 wrote to memory of 2056 2204 wmispqd.exe 104 PID 2204 wrote to memory of 2056 2204 wmispqd.exe 104 PID 2204 wrote to memory of 2056 2204 wmispqd.exe 104 PID 2056 wrote to memory of 4348 2056 wmispqd.exe 105 PID 2056 wrote to memory of 4348 2056 wmispqd.exe 105 PID 2056 wrote to memory of 4348 2056 wmispqd.exe 105 PID 2056 wrote to memory of 4348 2056 wmispqd.exe 105 PID 2056 wrote to memory of 4348 2056 wmispqd.exe 105 PID 2056 wrote to memory of 4348 2056 wmispqd.exe 105 PID 2056 wrote to memory of 4348 2056 wmispqd.exe 105 PID 4348 wrote to memory of 4364 4348 wmispqd.exe 106 PID 4348 wrote to memory of 4364 4348 wmispqd.exe 106 PID 4348 wrote to memory of 4364 4348 wmispqd.exe 106 PID 4364 wrote to memory of 3936 4364 wmispqd.exe 107 PID 4364 wrote to memory of 3936 4364 wmispqd.exe 107 PID 4364 wrote to memory of 3936 4364 wmispqd.exe 107 PID 4364 wrote to memory of 3936 4364 wmispqd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0e5c2b62d47728b11de9bbd9411f287.exe"C:\Users\Admin\AppData\Local\Temp\c0e5c2b62d47728b11de9bbd9411f287.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\c0e5c2b62d47728b11de9bbd9411f287.exeC:\Users\Admin\AppData\Local\Temp\c0e5c2b62d47728b11de9bbd9411f287.exe2⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Users\Admin\AppData\Local\Temp\C0E5C2~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Users\Admin\AppData\Local\Temp\C0E5C2~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3936 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4124 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4776 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3176 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1932 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1052 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2004 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3100 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2212 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4180 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3168 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4100 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1376 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:584 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4468 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:388 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1224 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4736 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1684 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4420 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe34⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3140 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:872 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1652 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2176 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4976 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2592 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:528 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4324 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe42⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5008 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3484 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5004 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3864 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2968 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3720 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4688 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4796 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2008 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2548 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4736 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3556 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3132 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4296 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe56⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3780 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2464 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe58⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3552 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2508 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe60⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4960 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4904 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe62⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1552 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4020 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe64⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3872 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:5052 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe66⤵
- Checks computer location settings
- Executes dropped EXE
PID:216 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe67⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:720 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe68⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:532 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe69⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:640 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe70⤵
- Checks computer location settings
- Modifies registry class
PID:4728 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe71⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3448 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe72⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:4992 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe73⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3676 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe74⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:2548 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe75⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4884 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe76⤵
- Checks computer location settings
PID:3688 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe77⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3968 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe78⤵
- Checks computer location settings
- Drops file in System32 directory
PID:836 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe79⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1316 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe80⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:792 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe81⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3368 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe82⤵
- Checks computer location settings
- Modifies registry class
PID:2576 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe83⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4612 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe84⤵
- Checks computer location settings
- Modifies registry class
PID:2196 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe85⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3376 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe86⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:4432 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe87⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4116 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe88⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3968 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe89⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1908 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe90⤵
- Modifies registry class
PID:3244 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe91⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2796 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe92⤵
- Checks computer location settings
- Drops file in System32 directory
PID:3516 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe93⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2936 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe94⤵PID:4020
-
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe95⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3256 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe96⤵
- Checks computer location settings
- Modifies registry class
PID:5104 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe97⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3508 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe98⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:1944 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe99⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3892 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe100⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:5044 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe101⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1900 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe102⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:4244 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe103⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1908 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe104⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3500 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe105⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4180 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe106⤵
- Modifies registry class
PID:1728 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe107⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4904 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe108⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3604 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe109⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2096 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe110⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3896 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe111⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3792 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe112⤵
- Checks computer location settings
- Modifies registry class
PID:1744 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe113⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2032 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe114⤵
- Checks computer location settings
- Modifies registry class
PID:3236 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe115⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2460 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe116⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:4900 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe117⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1064 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe118⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3632 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe119⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4752 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe120⤵
- Checks computer location settings
PID:3716 -
C:\Windows\SysWOW64\wmispqd.exe"C:\Windows\system32\wmispqd.exe" C:\Windows\SysWOW64\wmispqd.exe121⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3880 -
C:\Windows\SysWOW64\wmispqd.exeC:\Windows\SysWOW64\wmispqd.exe C:\Windows\SysWOW64\wmispqd.exe122⤵
- Checks computer location settings
- Modifies registry class
PID:680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-