File name:

wAYo.exe

Full analysis: https://app.any.run/tasks/639d9a06-7f9d-45d0-b9d5-dfbc562acf29
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 18:17:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
virlock
ransomware
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

D3BE276F4C722B1DA07A087990334E8A

SHA1:

6E053A558D1E8F0B247947921B24774CC122B0EC

SHA256:

4581B87C7ED2CC0B1A648F71C4E9F68B6606F2D3D5868A59093C9B30286EDE92

SSDEEP:

24576:Gw/QjLmBZAiZa5kciCUhF2Ra3EHggyTVpPTuXWpv7uBK:GyQjLmBZAea5fiCUhF2Ra3EHDyTVpPT1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • VIRLOCK mutex has been found

      • wAYo.exe (PID: 7636)
      • MgYMUYIA.exe (PID: 7656)
      • ZeggggYs.exe (PID: 7676)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 5392)
      • MgYMUYIA.exe (PID: 4408)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 7900)
      • wAYo.exe (PID: 4180)
      • ZeggggYs.exe (PID: 7336)
      • wAYo.exe (PID: 5048)
      • wAYo.exe (PID: 7348)
      • ZeggggYs.exe (PID: 2152)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 1168)

    • Changes the autorun value in the registry

      • wAYo.exe (PID: 7636)
      • ZeggggYs.exe (PID: 7676)
      • MgYMUYIA.exe (PID: 7656)
      • MgYMUYIA.exe (PID: 4408)
      • ZeggggYs.exe (PID: 7336)
      • ZeggggYs.exe (PID: 2152)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • cscript.exe (PID: 7956)
      • cscript.exe (PID: 7368)
      • cscript.exe (PID: 7580)
      • cscript.exe (PID: 3132)
      • cscript.exe (PID: 664)
      • cscript.exe (PID: 8144)
      • cscript.exe (PID: 7316)
      • cscript.exe (PID: 4652)
      • cscript.exe (PID: 8156)
      • cscript.exe (PID: 8000)
      • cscript.exe (PID: 7700)
      • cscript.exe (PID: 8076)
      • cscript.exe (PID: 3956)
      • cscript.exe (PID: 8124)
      • cscript.exe (PID: 660)
      • cscript.exe (PID: 1280)
      • cscript.exe (PID: 7792)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 4880)
      • cscript.exe (PID: 4268)
      • cscript.exe (PID: 2852)
      • cscript.exe (PID: 1616)
      • cscript.exe (PID: 7748)
      • cscript.exe (PID: 6028)
      • cscript.exe (PID: 7320)
      • cscript.exe (PID: 5204)
      • cscript.exe (PID: 7532)
      • cscript.exe (PID: 7716)
      • cscript.exe (PID: 7836)
      • cscript.exe (PID: 1852)
      • cscript.exe (PID: 516)
      • cscript.exe (PID: 1196)
      • cscript.exe (PID: 7196)
      • cscript.exe (PID: 7236)
      • cscript.exe (PID: 8032)
      • cscript.exe (PID: 7568)
      • cscript.exe (PID: 8004)
      • cscript.exe (PID: 8108)
      • cscript.exe (PID: 7652)
      • cscript.exe (PID: 1228)
      • cscript.exe (PID: 4620)
      • cscript.exe (PID: 7216)
      • cscript.exe (PID: 8032)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 7284)
      • cscript.exe (PID: 7892)
      • cscript.exe (PID: 2908)
      • cscript.exe (PID: 7632)
      • cscript.exe (PID: 7640)
      • cscript.exe (PID: 7916)

    • Modifies files in the Chrome extension folder

      • MgYMUYIA.exe (PID: 7656)

  • SUSPICIOUS

    • Mutex name with non-standard characters

      • MgYMUYIA.exe (PID: 7656)
      • ZeggggYs.exe (PID: 7676)
      • MgYMUYIA.exe (PID: 4408)
      • ZeggggYs.exe (PID: 7336)
      • ZeggggYs.exe (PID: 2152)

    • Executable content was dropped or overwritten

      • wAYo.exe (PID: 7636)
      • MgYMUYIA.exe (PID: 7656)

    • Executing commands from a ".bat" file

      • wAYo.exe (PID: 7636)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 5392)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 7900)
      • wAYo.exe (PID: 5048)
      • wAYo.exe (PID: 7348)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 1168)
      • wAYo.exe (PID: 7936)
      • wAYo.exe (PID: 7216)
      • wAYo.exe (PID: 4696)
      • wAYo.exe (PID: 5244)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 7920)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 920)
      • wAYo.exe (PID: 6032)
      • wAYo.exe (PID: 7832)
      • wAYo.exe (PID: 3300)
      • wAYo.exe (PID: 7264)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 5756)
      • wAYo.exe (PID: 7432)
      • wAYo.exe (PID: 6712)
      • wAYo.exe (PID: 2384)
      • wAYo.exe (PID: 1196)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6388)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 1452)
      • wAYo.exe (PID: 5892)
      • wAYo.exe (PID: 2552)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 6988)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 8080)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 5064)
      • wAYo.exe (PID: 2644)
      • wAYo.exe (PID: 4688)
      • wAYo.exe (PID: 8016)
      • wAYo.exe (PID: 7568)
      • wAYo.exe (PID: 7996)
      • wAYo.exe (PID: 8120)
      • wAYo.exe (PID: 5072)
      • wAYo.exe (PID: 7924)
      • wAYo.exe (PID: 6132)
      • wAYo.exe (PID: 7260)
      • wAYo.exe (PID: 4932)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 6660)
      • wAYo.exe (PID: 6620)
      • wAYo.exe (PID: 5008)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 856)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 6028)
      • wAYo.exe (PID: 6136)
      • wAYo.exe (PID: 7308)
      • wAYo.exe (PID: 7888)
      • wAYo.exe (PID: 7940)
      • wAYo.exe (PID: 7732)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 5324)
      • wAYo.exe (PID: 1056)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 7876)
      • wAYo.exe (PID: 8096)
      • wAYo.exe (PID: 8036)
      • wAYo.exe (PID: 2240)

    • Starts CMD.EXE for commands execution

      • wAYo.exe (PID: 7636)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 5392)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 7900)
      • wAYo.exe (PID: 5048)
      • wAYo.exe (PID: 7348)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 1168)
      • wAYo.exe (PID: 4696)
      • wAYo.exe (PID: 5244)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 7216)
      • wAYo.exe (PID: 7936)
      • wAYo.exe (PID: 920)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 7920)
      • wAYo.exe (PID: 6032)
      • wAYo.exe (PID: 7832)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1196)
      • wAYo.exe (PID: 3300)
      • wAYo.exe (PID: 7264)
      • wAYo.exe (PID: 6712)
      • wAYo.exe (PID: 2384)
      • wAYo.exe (PID: 7432)
      • wAYo.exe (PID: 5756)
      • wAYo.exe (PID: 6388)
      • wAYo.exe (PID: 1452)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 5892)
      • wAYo.exe (PID: 2552)
      • wAYo.exe (PID: 8080)
      • wAYo.exe (PID: 6988)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 5064)
      • wAYo.exe (PID: 2644)
      • wAYo.exe (PID: 4688)
      • wAYo.exe (PID: 5072)
      • wAYo.exe (PID: 7568)
      • wAYo.exe (PID: 8016)
      • wAYo.exe (PID: 7996)
      • wAYo.exe (PID: 8120)
      • wAYo.exe (PID: 7924)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 7260)
      • wAYo.exe (PID: 6132)
      • wAYo.exe (PID: 4932)
      • wAYo.exe (PID: 6660)
      • wAYo.exe (PID: 6620)
      • wAYo.exe (PID: 5008)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 856)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 6136)
      • wAYo.exe (PID: 6028)
      • wAYo.exe (PID: 7888)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 7308)
      • wAYo.exe (PID: 7940)
      • wAYo.exe (PID: 7732)
      • wAYo.exe (PID: 7876)
      • wAYo.exe (PID: 5324)
      • wAYo.exe (PID: 1056)
      • wAYo.exe (PID: 8096)
      • wAYo.exe (PID: 8036)
      • wAYo.exe (PID: 2240)

    • The process executes VB scripts

      • cmd.exe (PID: 7824)
      • cmd.exe (PID: 8184)
      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 6644)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 7700)
      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 1764)
      • cmd.exe (PID: 720)
      • cmd.exe (PID: 7308)
      • cmd.exe (PID: 7808)
      • cmd.exe (PID: 6404)
      • cmd.exe (PID: 7336)
      • cmd.exe (PID: 6564)
      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 7824)
      • cmd.exe (PID: 4784)
      • cmd.exe (PID: 7404)
      • cmd.exe (PID: 8176)
      • cmd.exe (PID: 7528)
      • cmd.exe (PID: 7188)
      • cmd.exe (PID: 5344)
      • cmd.exe (PID: 7536)
      • cmd.exe (PID: 7860)
      • cmd.exe (PID: 4784)
      • cmd.exe (PID: 7324)
      • cmd.exe (PID: 8052)
      • cmd.exe (PID: 7604)
      • cmd.exe (PID: 7956)
      • cmd.exe (PID: 8152)
      • cmd.exe (PID: 7780)
      • cmd.exe (PID: 5400)
      • cmd.exe (PID: 2560)
      • cmd.exe (PID: 7548)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 7876)
      • cmd.exe (PID: 6516)
      • cmd.exe (PID: 8036)
      • cmd.exe (PID: 6640)
      • cmd.exe (PID: 6944)
      • cmd.exe (PID: 2772)
      • cmd.exe (PID: 6112)
      • cmd.exe (PID: 6512)
      • cmd.exe (PID: 8116)
      • cmd.exe (PID: 5156)
      • cmd.exe (PID: 7412)
      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7716)
      • cmd.exe (PID: 7544)
      • cmd.exe (PID: 6404)
      • cmd.exe (PID: 7916)
      • cmd.exe (PID: 2984)
      • cmd.exe (PID: 8156)
      • cmd.exe (PID: 8052)
      • cmd.exe (PID: 1568)
      • cmd.exe (PID: 5324)
      • cmd.exe (PID: 7300)
      • cmd.exe (PID: 7360)
      • cmd.exe (PID: 1328)
      • cmd.exe (PID: 5392)
      • cmd.exe (PID: 6424)
      • cmd.exe (PID: 4920)
      • cmd.exe (PID: 7316)
      • cmd.exe (PID: 8172)
      • cmd.exe (PID: 7356)
      • cmd.exe (PID: 7900)
      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 8040)
      • cmd.exe (PID: 1300)
      • cmd.exe (PID: 7292)
      • cmd.exe (PID: 7836)
      • cmd.exe (PID: 7264)
      • cmd.exe (PID: 5200)
      • cmd.exe (PID: 4784)
      • cmd.exe (PID: 7348)
      • cmd.exe (PID: 7912)
      • cmd.exe (PID: 668)
      • cmd.exe (PID: 7568)
      • cmd.exe (PID: 7708)
      • cmd.exe (PID: 7724)
      • cmd.exe (PID: 8152)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 5756)
      • cmd.exe (PID: 5600)
      • cmd.exe (PID: 2136)
      • cmd.exe (PID: 8152)
      • cmd.exe (PID: 7692)
      • cmd.exe (PID: 7212)
      • cmd.exe (PID: 6228)
      • cmd.exe (PID: 5984)
      • cmd.exe (PID: 8180)
      • cmd.exe (PID: 4452)
      • cmd.exe (PID: 4756)
      • cmd.exe (PID: 6644)
      • cmd.exe (PID: 472)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 6808)
      • cmd.exe (PID: 2320)
      • cmd.exe (PID: 5728)
      • cmd.exe (PID: 7712)
      • cmd.exe (PID: 4724)
      • cmd.exe (PID: 7216)
      • cmd.exe (PID: 7212)
      • cmd.exe (PID: 6652)
      • cmd.exe (PID: 7272)
      • cmd.exe (PID: 7524)
      • cmd.exe (PID: 7220)
      • cmd.exe (PID: 7912)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 616)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 4844)

    • Uses REG/REGEDIT.EXE to modify registry

      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 7636)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 5392)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 7900)
      • wAYo.exe (PID: 7348)
      • wAYo.exe (PID: 5048)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 1168)
      • wAYo.exe (PID: 7936)
      • wAYo.exe (PID: 4696)
      • wAYo.exe (PID: 5244)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 7216)
      • wAYo.exe (PID: 7920)
      • wAYo.exe (PID: 3300)
      • wAYo.exe (PID: 920)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 6032)
      • wAYo.exe (PID: 7264)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1196)
      • wAYo.exe (PID: 7832)
      • wAYo.exe (PID: 5756)
      • wAYo.exe (PID: 6712)
      • wAYo.exe (PID: 2384)
      • wAYo.exe (PID: 7432)
      • wAYo.exe (PID: 6388)
      • wAYo.exe (PID: 5892)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 1452)
      • wAYo.exe (PID: 2552)
      • wAYo.exe (PID: 8080)
      • wAYo.exe (PID: 6988)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 5064)
      • wAYo.exe (PID: 2644)
      • wAYo.exe (PID: 4688)
      • wAYo.exe (PID: 5072)
      • wAYo.exe (PID: 8016)
      • wAYo.exe (PID: 7996)
      • wAYo.exe (PID: 7924)
      • wAYo.exe (PID: 8120)
      • wAYo.exe (PID: 7568)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 7260)
      • wAYo.exe (PID: 6132)
      • wAYo.exe (PID: 4932)
      • wAYo.exe (PID: 6660)
      • wAYo.exe (PID: 6620)
      • wAYo.exe (PID: 5008)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 856)
      • wAYo.exe (PID: 7888)
      • wAYo.exe (PID: 6028)
      • wAYo.exe (PID: 7308)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 7940)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 6136)
      • wAYo.exe (PID: 7732)
      • wAYo.exe (PID: 7876)
      • wAYo.exe (PID: 5324)
      • wAYo.exe (PID: 1056)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 8036)
      • wAYo.exe (PID: 7856)
      • wAYo.exe (PID: 2240)
      • wAYo.exe (PID: 8096)

    • The process checks if it is being run in the virtual environment

      • MgYMUYIA.exe (PID: 7656)

  • INFO

    • Checks supported languages

      • wAYo.exe (PID: 7636)
      • MgYMUYIA.exe (PID: 7656)
      • ZeggggYs.exe (PID: 7676)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 5392)
      • wAYo.exe (PID: 1180)
      • MgYMUYIA.exe (PID: 4408)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 7900)
      • ZeggggYs.exe (PID: 7336)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 7348)
      • wAYo.exe (PID: 5048)
      • ZeggggYs.exe (PID: 2152)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 1168)

    • Creates files in the program directory

      • wAYo.exe (PID: 7636)
      • MgYMUYIA.exe (PID: 7656)

    • Reads the computer name

      • MgYMUYIA.exe (PID: 7656)
      • wAYo.exe (PID: 7636)
      • ZeggggYs.exe (PID: 7676)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 5392)
      • wAYo.exe (PID: 1180)
      • MgYMUYIA.exe (PID: 4408)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 7900)
      • wAYo.exe (PID: 5048)
      • ZeggggYs.exe (PID: 7336)
      • wAYo.exe (PID: 7348)
      • ZeggggYs.exe (PID: 2152)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 1168)

    • Auto-launch of the file from Registry key

      • wAYo.exe (PID: 7636)
      • ZeggggYs.exe (PID: 7676)
      • MgYMUYIA.exe (PID: 7656)
      • MgYMUYIA.exe (PID: 4408)
      • ZeggggYs.exe (PID: 7336)
      • ZeggggYs.exe (PID: 2152)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 7956)
      • cscript.exe (PID: 7368)
      • cscript.exe (PID: 7580)
      • cscript.exe (PID: 3132)
      • cscript.exe (PID: 664)
      • cscript.exe (PID: 8144)
      • cscript.exe (PID: 7316)
      • cscript.exe (PID: 4652)
      • cscript.exe (PID: 8000)
      • cscript.exe (PID: 8156)
      • cscript.exe (PID: 7700)
      • cscript.exe (PID: 3956)
      • cscript.exe (PID: 8076)
      • cscript.exe (PID: 660)
      • cscript.exe (PID: 8124)
      • cscript.exe (PID: 1280)
      • cscript.exe (PID: 7792)
      • cscript.exe (PID: 4880)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 4268)
      • cscript.exe (PID: 2852)
      • cscript.exe (PID: 1616)
      • cscript.exe (PID: 7748)
      • cscript.exe (PID: 6028)
      • cscript.exe (PID: 7320)
      • cscript.exe (PID: 5204)
      • cscript.exe (PID: 7532)
      • cscript.exe (PID: 7836)
      • cscript.exe (PID: 7716)
      • cscript.exe (PID: 1852)
      • cscript.exe (PID: 516)
      • cscript.exe (PID: 8032)
      • cscript.exe (PID: 1196)
      • cscript.exe (PID: 7196)
      • cscript.exe (PID: 7236)
      • cscript.exe (PID: 7568)
      • cscript.exe (PID: 8004)
      • cscript.exe (PID: 8108)
      • cscript.exe (PID: 7652)
      • cscript.exe (PID: 1228)
      • cscript.exe (PID: 4620)
      • cscript.exe (PID: 8032)
      • cscript.exe (PID: 7216)
      • cscript.exe (PID: 7284)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 2908)
      • cscript.exe (PID: 7892)
      • cscript.exe (PID: 7632)
      • cscript.exe (PID: 7640)
      • cscript.exe (PID: 7916)
      • cscript.exe (PID: 1348)

    • Create files in a temporary directory

      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 7636)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 5392)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 7900)
      • wAYo.exe (PID: 5048)
      • wAYo.exe (PID: 7348)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 1168)

    • Manual execution by a user

      • MgYMUYIA.exe (PID: 4408)
      • ZeggggYs.exe (PID: 7336)
      • ZeggggYs.exe (PID: 2152)

    • Creates files or folders in the user directory

      • MgYMUYIA.exe (PID: 7656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:01:06 00:36:08+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 492544
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
1 516
Monitored processes
1 393
Malicious processes
105
Suspicious processes
141

Behavior graph

Click at the process to see the details
start #VIRLOCK wayo.exe #VIRLOCK mgymuyia.exe #VIRLOCK zeggggys.exe cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK wayo.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs #VIRLOCK mgymuyia.exe cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs #VIRLOCK zeggggys.exe cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK zeggggys.exe cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cscript.exe no specs #VIRLOCK wayo.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK wayo.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK wayo.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK wayo.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs wayo.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs wayo.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs wayo.exe no specs cscript.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
208reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /fC:\Windows\SysWOW64\reg.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
472reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1C:\Windows\SysWOW64\reg.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
472\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
472C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\HcsAQYYg.bat" "C:\Users\admin\Desktop\wAYo.exe""C:\Windows\SysWOW64\cmd.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1C:\Windows\SysWOW64\reg.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /fC:\Windows\SysWOW64\reg.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
51 757
Read events
51 750
Write events
7
Delete events
0

Modification events

(PID) Process:(7656) MgYMUYIA.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MgYMUYIA.exe
Value:
C:\Users\admin\TcQkAsEE\MgYMUYIA.exe
(PID) Process:(7676) ZeggggYs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZeggggYs.exe
Value:
C:\ProgramData\EOUcAIQY\ZeggggYs.exe
(PID) Process:(7636) wAYo.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MgYMUYIA.exe
Value:
C:\Users\admin\TcQkAsEE\MgYMUYIA.exe
(PID) Process:(7636) wAYo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZeggggYs.exe
Value:
C:\ProgramData\EOUcAIQY\ZeggggYs.exe
(PID) Process:(4408) MgYMUYIA.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MgYMUYIA.exe
Value:
C:\Users\admin\TcQkAsEE\MgYMUYIA.exe
(PID) Process:(7336) ZeggggYs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZeggggYs.exe
Value:
C:\ProgramData\EOUcAIQY\ZeggggYs.exe
(PID) Process:(2152) ZeggggYs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZeggggYs.exe
Value:
C:\ProgramData\EOUcAIQY\ZeggggYs.exe
Executable files
329
Suspicious files
6
Text files
207
Unknown types
0

Dropped files

PID
Process
Filename
Type
7636wAYo.exeC:\Users\admin\AppData\Local\Temp\yuQIoQkw.battext
MD5:7BE1C2C94ED3C3691E64E679A3D74983
SHA256:D290A2CA29CE5B8F3228562D8BB7B756CD3A5FC0BAE65F2719FDA568E52628D0
7824cmd.exeC:\Users\admin\AppData\Local\Temp\file.vbstext
MD5:4AFB5C4527091738FAF9CD4ADDF9D34E
SHA256:59D889A2BF392F4B117340832B4C73425A7FB1DE6C2F83A1AAA779D477C7C6CC
7636wAYo.exeC:\Users\admin\TcQkAsEE\MgYMUYIA.exeexecutable
MD5:D23F3E1A7CF9A9BF4D88A90264E1D732
SHA256:BBC0475034BC503222A5C78D03E487B19AAA34478FC4899BB116041FF66F8FB6
7744wAYo.exeC:\Users\admin\AppData\Local\Temp\vGoQoQkw.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
7636wAYo.exeC:\Users\admin\AppData\Local\Temp\fewIoQkw.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
7424wAYo.exeC:\Users\admin\AppData\Local\Temp\isIooQkw.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
7636wAYo.exeC:\Users\admin\Desktop\wAYoimage
MD5:B0DE08B6AADA24CDD3458113D175F1A7
SHA256:40015814487B93A8372F33284D45586739A4A1E9D2B7961AB8C6D4D9561D10CB
8108wAYo.exeC:\Users\admin\AppData\Local\Temp\TkUYoQkw.battext
MD5:0B161C962E130DF2A72FF550B999502A
SHA256:BF667CF63F36EB2322EC0BB42CE430089BF6FD6275FBFBCF0631DA3765D93C7B
8108wAYo.exeC:\Users\admin\AppData\Local\Temp\hgMgoQkw.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
7744wAYo.exeC:\Users\admin\AppData\Local\Temp\DCQQoQkw.battext
MD5:A7B88651176F3F6E5406285A88D09C40
SHA256:3019207C009F7855457446ED3CD04D6B8A8424673F8B3B91C33C653D87CDD817
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
35
DNS requests
5
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7676
ZeggggYs.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
7656
MgYMUYIA.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4408
MgYMUYIA.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
2152
ZeggggYs.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
7336
ZeggggYs.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
7656
MgYMUYIA.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
4408
MgYMUYIA.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
7336
ZeggggYs.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7656
MgYMUYIA.exe
216.58.206.46:80
google.com
GOOGLE
US
whitelisted
7676
ZeggggYs.exe
216.58.206.46:80
google.com
GOOGLE
US
whitelisted
2104
svchost.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2104
svchost.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4408
MgYMUYIA.exe
216.58.206.46:80
google.com
GOOGLE
US
whitelisted
7336
ZeggggYs.exe
216.58.206.46:80
google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
7676
ZeggggYs.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7656
MgYMUYIA.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7656
MgYMUYIA.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com)
4408
MgYMUYIA.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7336
ZeggggYs.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
2152
ZeggggYs.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7656
MgYMUYIA.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
4408
MgYMUYIA.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7336
ZeggggYs.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7336
ZeggggYs.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wAYo.exe