File name:

wAYo.exe

Full analysis: https://app.any.run/tasks/004198ab-00ef-4565-89eb-278f2f80acb3
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 09:22:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
virlock
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

D3BE276F4C722B1DA07A087990334E8A

SHA1:

6E053A558D1E8F0B247947921B24774CC122B0EC

SHA256:

4581B87C7ED2CC0B1A648F71C4E9F68B6606F2D3D5868A59093C9B30286EDE92

SSDEEP:

24576:Gw/QjLmBZAiZa5kciCUhF2Ra3EHggyTVpPTuXWpv7uBK:GyQjLmBZAea5fiCUhF2Ra3EHDyTVpPT1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • VIRLOCK mutex has been found

      • wAYo.exe (PID: 7000)
      • MgYMUYIA.exe (PID: 6040)
      • ZeggggYs.exe (PID: 6032)
      • wAYo.exe (PID: 6480)
      • wAYo.exe (PID: 976)
      • wAYo.exe (PID: 1324)

    • Changes the autorun value in the registry

      • wAYo.exe (PID: 7000)
      • MgYMUYIA.exe (PID: 6040)
      • ZeggggYs.exe (PID: 6032)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • cscript.exe (PID: 5344)
      • cscript.exe (PID: 6744)

    • Modifies files in the Chrome extension folder

      • ZeggggYs.exe (PID: 6032)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • wAYo.exe (PID: 7000)
      • ZeggggYs.exe (PID: 6032)

    • Starts CMD.EXE for commands execution

      • wAYo.exe (PID: 7000)
      • wAYo.exe (PID: 6480)
      • wAYo.exe (PID: 976)

    • Mutex name with non-standard characters

      • MgYMUYIA.exe (PID: 6040)
      • ZeggggYs.exe (PID: 6032)

    • Uses REG/REGEDIT.EXE to modify registry

      • wAYo.exe (PID: 7000)
      • wAYo.exe (PID: 6480)
      • wAYo.exe (PID: 976)

    • The executable file from the user directory is run by the CMD process

      • wAYo.exe (PID: 6480)
      • wAYo.exe (PID: 976)
      • wAYo.exe (PID: 1324)

    • Executing commands from a ".bat" file

      • wAYo.exe (PID: 7000)
      • wAYo.exe (PID: 6480)
      • wAYo.exe (PID: 976)

    • The process executes VB scripts

      • cmd.exe (PID: 3100)
      • cmd.exe (PID: 5392)

    • Start notepad (likely ransomware note)

      • ZeggggYs.exe (PID: 6032)

  • INFO

    • Reads the computer name

      • MgYMUYIA.exe (PID: 6040)
      • wAYo.exe (PID: 7000)
      • ZeggggYs.exe (PID: 6032)
      • wAYo.exe (PID: 6480)
      • wAYo.exe (PID: 976)
      • wAYo.exe (PID: 1324)

    • Checks supported languages

      • wAYo.exe (PID: 7000)
      • MgYMUYIA.exe (PID: 6040)
      • ZeggggYs.exe (PID: 6032)
      • wAYo.exe (PID: 6480)
      • wAYo.exe (PID: 976)
      • wAYo.exe (PID: 1324)

    • Creates files in the program directory

      • wAYo.exe (PID: 7000)
      • ZeggggYs.exe (PID: 6032)

    • Create files in a temporary directory

      • wAYo.exe (PID: 7000)
      • wAYo.exe (PID: 6480)
      • wAYo.exe (PID: 1324)
      • ZeggggYs.exe (PID: 6032)
      • wAYo.exe (PID: 976)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 5344)
      • cscript.exe (PID: 6744)

    • Application launched itself

      • msedge.exe (PID: 5392)
      • msedge.exe (PID: 5124)

    • Creates files or folders in the user directory

      • ZeggggYs.exe (PID: 6032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:01:06 00:36:08+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 492544
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
1 265
Monitored processes
61
Malicious processes
12
Suspicious processes
9

Behavior graph

Click at the process to see the details
start #VIRLOCK wayo.exe #VIRLOCK mgymuyia.exe #VIRLOCK zeggggys.exe cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs iexplore.exe no specs iexplore.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs notepad.exe no specs iexplore.exe no specs iexplore.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1C:\Windows\SysWOW64\reg.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
780reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1C:\Windows\SysWOW64\reg.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
976C:\Users\admin\AppData\Local\Temp\wAYoC:\Users\admin\AppData\Local\Temp\wAYo.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\wayo.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
1020\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052C:\WINDOWS\system32\cmd.exe /c "C:\Users\admin\AppData\Local\Temp\wAYo"C:\Windows\SysWOW64\cmd.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1072reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /fC:\Windows\SysWOW64\reg.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1136"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2308 --field-trial-handle=2312,i,13876044750144254081,12193439680987751698,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1196\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324C:\Users\admin\AppData\Local\Temp\wAYoC:\Users\admin\AppData\Local\Temp\wAYo.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\wayo.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
Total events
8 029
Read events
8 000
Write events
29
Delete events
0

Modification events

(PID) Process:(7000) wAYo.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MgYMUYIA.exe
Value:
C:\Users\admin\TcQkAsEE\MgYMUYIA.exe
(PID) Process:(7000) wAYo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZeggggYs.exe
Value:
C:\ProgramData\EOUcAIQY\ZeggggYs.exe
(PID) Process:(6040) MgYMUYIA.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MgYMUYIA.exe
Value:
C:\Users\admin\TcQkAsEE\MgYMUYIA.exe
(PID) Process:(6032) ZeggggYs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZeggggYs.exe
Value:
C:\ProgramData\EOUcAIQY\ZeggggYs.exe
(PID) Process:(8072) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8072) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8072) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8072) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(8072) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(8072) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
Executable files
334
Suspicious files
39
Text files
141
Unknown types
0

Dropped files

PID
Process
Filename
Type
7000wAYo.exeC:\Users\admin\TcQkAsEE\MgYMUYIA.exeexecutable
MD5:1A153AAF1CE308DBB9B550CA12C0D90D
SHA256:DFD839556D521ABBD8C3950A46150CE37AF41789C97C06BC098E465AA6644120
7000wAYo.exeC:\Users\admin\AppData\Local\Temp\wAYoimage
MD5:B0DE08B6AADA24CDD3458113D175F1A7
SHA256:40015814487B93A8372F33284D45586739A4A1E9D2B7961AB8C6D4D9561D10CB
7000wAYo.exeC:\ProgramData\EOUcAIQY\ZeggggYs.exeexecutable
MD5:743D2DA6F6BEE8CE6DD1A2CCD8564A04
SHA256:5875B86E56621FE38C8CA0E27B559B41FF5FC59FE740EB9467550CBCA34FD1E3
7000wAYo.exeC:\Users\admin\AppData\Local\Temp\bOAoAgMU.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
3100cmd.exeC:\Users\admin\AppData\Local\Temp\file.vbstext
MD5:4AFB5C4527091738FAF9CD4ADDF9D34E
SHA256:59D889A2BF392F4B117340832B4C73425A7FB1DE6C2F83A1AAA779D477C7C6CC
6480wAYo.exeC:\Users\admin\AppData\Local\Temp\lGMoAgMU.battext
MD5:2CF6BD874E6B57F1A3A832BC4C32E253
SHA256:FA77212BB4570662F058336083A43738D7B35ECAE08542953F16FACDB4018986
7000wAYo.exeC:\ProgramData\KiUUYEYs\VcggwQIk.exeexecutable
MD5:4F7352270FE7BE9A0A62D56E65D98830
SHA256:859A0F943D16CDC7F55F3F272811475677AA411CF097A6EC0B84D3F7D56457E2
7000wAYo.exeC:\Users\admin\AppData\Local\Temp\GuYgAgMU.battext
MD5:F69316D9D470E579889AD9AE10DDA2DD
SHA256:ACA0C9426570EF3E34262B0716FA5406E091D310D1CAED70B99C8C0E2FFB724F
6480wAYo.exeC:\Users\admin\AppData\Local\Temp\pKkoAgMU.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
6032ZeggggYs.exeC:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exeexecutable
MD5:EDC94C931EF69224823F879400845535
SHA256:4DD57893B1CA6B0EAF8DE5DE168FB6EEF021A595D237C6D703845BFA9B24D882
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
32
DNS requests
29
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6040
MgYMUYIA.exe
GET
301
142.250.185.142:80
http://google.com/
unknown
—
—
whitelisted
6032
ZeggggYs.exe
GET
301
142.250.185.142:80
http://google.com/
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7220
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7220
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6040
MgYMUYIA.exe
142.250.185.142:80
google.com
GOOGLE
US
whitelisted
6032
ZeggggYs.exe
142.250.185.142:80
google.com
GOOGLE
US
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.22
  • 23.216.77.35
  • 23.216.77.30
  • 23.216.77.28
  • 23.216.77.21
  • 23.216.77.19
  • 23.216.77.20
  • 23.216.77.31
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 88.221.169.152
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.128
  • 40.126.31.73
  • 40.126.31.0
  • 20.190.159.23
  • 20.190.159.73
  • 20.190.159.128
  • 20.190.159.0
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
config.edge.skype.com
  • 13.107.43.16
whitelisted

Threats

PID
Process
Class
Message
6040
MgYMUYIA.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
6032
ZeggggYs.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
6032
ZeggggYs.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wAYo.exe