File name:

wAYo.exe

Full analysis: https://app.any.run/tasks/639d9a06-7f9d-45d0-b9d5-dfbc562acf29
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 18:17:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
virlock
ransomware
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

D3BE276F4C722B1DA07A087990334E8A

SHA1:

6E053A558D1E8F0B247947921B24774CC122B0EC

SHA256:

4581B87C7ED2CC0B1A648F71C4E9F68B6606F2D3D5868A59093C9B30286EDE92

SSDEEP:

24576:Gw/QjLmBZAiZa5kciCUhF2Ra3EHggyTVpPTuXWpv7uBK:GyQjLmBZAea5fiCUhF2Ra3EHDyTVpPT1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • VIRLOCK mutex has been found

      • wAYo.exe (PID: 7636)
      • ZeggggYs.exe (PID: 7676)
      • MgYMUYIA.exe (PID: 7656)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 5392)
      • MgYMUYIA.exe (PID: 4408)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 4180)
      • ZeggggYs.exe (PID: 7336)
      • wAYo.exe (PID: 7900)
      • wAYo.exe (PID: 7348)
      • wAYo.exe (PID: 5048)
      • ZeggggYs.exe (PID: 2152)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 1168)

    • Changes the autorun value in the registry

      • MgYMUYIA.exe (PID: 7656)
      • wAYo.exe (PID: 7636)
      • ZeggggYs.exe (PID: 7676)
      • MgYMUYIA.exe (PID: 4408)
      • ZeggggYs.exe (PID: 7336)
      • ZeggggYs.exe (PID: 2152)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • cscript.exe (PID: 7956)
      • cscript.exe (PID: 7368)
      • cscript.exe (PID: 7580)
      • cscript.exe (PID: 3132)
      • cscript.exe (PID: 664)
      • cscript.exe (PID: 8144)
      • cscript.exe (PID: 7316)
      • cscript.exe (PID: 4652)
      • cscript.exe (PID: 8000)
      • cscript.exe (PID: 7700)
      • cscript.exe (PID: 8156)
      • cscript.exe (PID: 3956)
      • cscript.exe (PID: 8124)
      • cscript.exe (PID: 8076)
      • cscript.exe (PID: 660)
      • cscript.exe (PID: 1280)
      • cscript.exe (PID: 7792)
      • cscript.exe (PID: 4880)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 4268)
      • cscript.exe (PID: 2852)
      • cscript.exe (PID: 1616)
      • cscript.exe (PID: 7748)
      • cscript.exe (PID: 6028)
      • cscript.exe (PID: 7320)
      • cscript.exe (PID: 5204)
      • cscript.exe (PID: 7532)
      • cscript.exe (PID: 7836)
      • cscript.exe (PID: 7716)
      • cscript.exe (PID: 1852)
      • cscript.exe (PID: 516)
      • cscript.exe (PID: 1196)
      • cscript.exe (PID: 8032)
      • cscript.exe (PID: 7236)
      • cscript.exe (PID: 7196)
      • cscript.exe (PID: 7568)
      • cscript.exe (PID: 8004)
      • cscript.exe (PID: 8108)
      • cscript.exe (PID: 7652)
      • cscript.exe (PID: 1228)
      • cscript.exe (PID: 4620)
      • cscript.exe (PID: 8032)
      • cscript.exe (PID: 7216)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 7284)
      • cscript.exe (PID: 7892)
      • cscript.exe (PID: 2908)
      • cscript.exe (PID: 7632)
      • cscript.exe (PID: 7640)
      • cscript.exe (PID: 7916)

    • Modifies files in the Chrome extension folder

      • MgYMUYIA.exe (PID: 7656)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • wAYo.exe (PID: 7636)
      • MgYMUYIA.exe (PID: 7656)

    • Mutex name with non-standard characters

      • MgYMUYIA.exe (PID: 7656)
      • ZeggggYs.exe (PID: 7676)
      • MgYMUYIA.exe (PID: 4408)
      • ZeggggYs.exe (PID: 7336)
      • ZeggggYs.exe (PID: 2152)

    • Uses REG/REGEDIT.EXE to modify registry

      • wAYo.exe (PID: 7636)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5392)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 7900)
      • wAYo.exe (PID: 5048)
      • wAYo.exe (PID: 7348)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 7216)
      • wAYo.exe (PID: 4696)
      • wAYo.exe (PID: 7936)
      • wAYo.exe (PID: 5244)
      • wAYo.exe (PID: 1168)
      • wAYo.exe (PID: 920)
      • wAYo.exe (PID: 7920)
      • wAYo.exe (PID: 6032)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 3300)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 7832)
      • wAYo.exe (PID: 7264)
      • wAYo.exe (PID: 2384)
      • wAYo.exe (PID: 5756)
      • wAYo.exe (PID: 6712)
      • wAYo.exe (PID: 1196)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6388)
      • wAYo.exe (PID: 1452)
      • wAYo.exe (PID: 5892)
      • wAYo.exe (PID: 7432)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 2552)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 8080)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 6988)
      • wAYo.exe (PID: 2644)
      • wAYo.exe (PID: 5072)
      • wAYo.exe (PID: 4688)
      • wAYo.exe (PID: 7568)
      • wAYo.exe (PID: 5064)
      • wAYo.exe (PID: 7996)
      • wAYo.exe (PID: 8120)
      • wAYo.exe (PID: 7924)
      • wAYo.exe (PID: 8016)
      • wAYo.exe (PID: 4932)
      • wAYo.exe (PID: 7260)
      • wAYo.exe (PID: 6132)
      • wAYo.exe (PID: 6660)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 5008)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 856)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 6620)
      • wAYo.exe (PID: 6028)
      • wAYo.exe (PID: 7888)
      • wAYo.exe (PID: 7308)
      • wAYo.exe (PID: 6136)
      • wAYo.exe (PID: 7732)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 7876)
      • wAYo.exe (PID: 7940)
      • wAYo.exe (PID: 5324)
      • wAYo.exe (PID: 1056)
      • wAYo.exe (PID: 2240)
      • wAYo.exe (PID: 8096)
      • wAYo.exe (PID: 7856)
      • wAYo.exe (PID: 8036)

    • Starts CMD.EXE for commands execution

      • wAYo.exe (PID: 7636)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 5392)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 7900)
      • wAYo.exe (PID: 5048)
      • wAYo.exe (PID: 7348)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 1168)
      • wAYo.exe (PID: 7216)
      • wAYo.exe (PID: 4696)
      • wAYo.exe (PID: 5244)
      • wAYo.exe (PID: 7936)
      • wAYo.exe (PID: 7920)
      • wAYo.exe (PID: 6032)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 920)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 3300)
      • wAYo.exe (PID: 7832)
      • wAYo.exe (PID: 7264)
      • wAYo.exe (PID: 5756)
      • wAYo.exe (PID: 2384)
      • wAYo.exe (PID: 1196)
      • wAYo.exe (PID: 6712)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 1452)
      • wAYo.exe (PID: 5892)
      • wAYo.exe (PID: 7432)
      • wAYo.exe (PID: 6388)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 2552)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 8080)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 6988)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 2644)
      • wAYo.exe (PID: 4688)
      • wAYo.exe (PID: 5072)
      • wAYo.exe (PID: 5064)
      • wAYo.exe (PID: 8016)
      • wAYo.exe (PID: 7924)
      • wAYo.exe (PID: 7996)
      • wAYo.exe (PID: 8120)
      • wAYo.exe (PID: 7568)
      • wAYo.exe (PID: 7260)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 6132)
      • wAYo.exe (PID: 4932)
      • wAYo.exe (PID: 6660)
      • wAYo.exe (PID: 6620)
      • wAYo.exe (PID: 5008)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 856)
      • wAYo.exe (PID: 7888)
      • wAYo.exe (PID: 7308)
      • wAYo.exe (PID: 6136)
      • wAYo.exe (PID: 7940)
      • wAYo.exe (PID: 6028)
      • wAYo.exe (PID: 7732)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 7876)
      • wAYo.exe (PID: 8096)
      • wAYo.exe (PID: 1056)
      • wAYo.exe (PID: 2240)
      • wAYo.exe (PID: 5324)
      • wAYo.exe (PID: 8036)

    • The process executes VB scripts

      • cmd.exe (PID: 7824)
      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 8184)
      • cmd.exe (PID: 6644)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 7700)
      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 720)
      • cmd.exe (PID: 1764)
      • cmd.exe (PID: 7308)
      • cmd.exe (PID: 7808)
      • cmd.exe (PID: 6404)
      • cmd.exe (PID: 6564)
      • cmd.exe (PID: 7336)
      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 4784)
      • cmd.exe (PID: 7824)
      • cmd.exe (PID: 7404)
      • cmd.exe (PID: 7528)
      • cmd.exe (PID: 7188)
      • cmd.exe (PID: 8176)
      • cmd.exe (PID: 5344)
      • cmd.exe (PID: 7536)
      • cmd.exe (PID: 7860)
      • cmd.exe (PID: 7324)
      • cmd.exe (PID: 4784)
      • cmd.exe (PID: 7604)
      • cmd.exe (PID: 8052)
      • cmd.exe (PID: 7956)
      • cmd.exe (PID: 8152)
      • cmd.exe (PID: 7780)
      • cmd.exe (PID: 5400)
      • cmd.exe (PID: 2560)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 7548)
      • cmd.exe (PID: 7876)
      • cmd.exe (PID: 8036)
      • cmd.exe (PID: 6516)
      • cmd.exe (PID: 6640)
      • cmd.exe (PID: 6944)
      • cmd.exe (PID: 6112)
      • cmd.exe (PID: 2772)
      • cmd.exe (PID: 6512)
      • cmd.exe (PID: 8116)
      • cmd.exe (PID: 5156)
      • cmd.exe (PID: 7412)
      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7716)
      • cmd.exe (PID: 7544)
      • cmd.exe (PID: 8052)
      • cmd.exe (PID: 6404)
      • cmd.exe (PID: 7916)
      • cmd.exe (PID: 8156)
      • cmd.exe (PID: 1568)
      • cmd.exe (PID: 5324)
      • cmd.exe (PID: 7300)
      • cmd.exe (PID: 2984)
      • cmd.exe (PID: 7360)
      • cmd.exe (PID: 4920)
      • cmd.exe (PID: 1328)
      • cmd.exe (PID: 5392)
      • cmd.exe (PID: 7900)
      • cmd.exe (PID: 7316)
      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 6424)
      • cmd.exe (PID: 7836)
      • cmd.exe (PID: 1300)
      • cmd.exe (PID: 8172)
      • cmd.exe (PID: 7356)
      • cmd.exe (PID: 8040)
      • cmd.exe (PID: 5200)
      • cmd.exe (PID: 7264)
      • cmd.exe (PID: 4784)
      • cmd.exe (PID: 7348)
      • cmd.exe (PID: 7292)
      • cmd.exe (PID: 668)
      • cmd.exe (PID: 7912)
      • cmd.exe (PID: 7568)
      • cmd.exe (PID: 7708)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 8152)
      • cmd.exe (PID: 7692)
      • cmd.exe (PID: 7724)
      • cmd.exe (PID: 5600)
      • cmd.exe (PID: 5756)
      • cmd.exe (PID: 8152)
      • cmd.exe (PID: 6228)
      • cmd.exe (PID: 2136)
      • cmd.exe (PID: 7212)
      • cmd.exe (PID: 5984)
      • cmd.exe (PID: 8180)
      • cmd.exe (PID: 4452)
      • cmd.exe (PID: 6808)
      • cmd.exe (PID: 6644)
      • cmd.exe (PID: 4756)
      • cmd.exe (PID: 472)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 5728)
      • cmd.exe (PID: 7712)
      • cmd.exe (PID: 4724)
      • cmd.exe (PID: 6652)
      • cmd.exe (PID: 2320)
      • cmd.exe (PID: 7216)
      • cmd.exe (PID: 7212)
      • cmd.exe (PID: 7912)
      • cmd.exe (PID: 7272)
      • cmd.exe (PID: 7220)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 4844)
      • cmd.exe (PID: 7524)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 616)

    • Executing commands from a ".bat" file

      • wAYo.exe (PID: 7636)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5392)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 7900)
      • wAYo.exe (PID: 5048)
      • wAYo.exe (PID: 7348)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 1168)
      • wAYo.exe (PID: 7216)
      • wAYo.exe (PID: 4696)
      • wAYo.exe (PID: 7936)
      • wAYo.exe (PID: 5244)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 7920)
      • wAYo.exe (PID: 6032)
      • wAYo.exe (PID: 920)
      • wAYo.exe (PID: 7264)
      • wAYo.exe (PID: 7832)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 3300)
      • wAYo.exe (PID: 6712)
      • wAYo.exe (PID: 2384)
      • wAYo.exe (PID: 1196)
      • wAYo.exe (PID: 5756)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6388)
      • wAYo.exe (PID: 1452)
      • wAYo.exe (PID: 5892)
      • wAYo.exe (PID: 7432)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 2552)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 8080)
      • wAYo.exe (PID: 5436)
      • wAYo.exe (PID: 6456)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 6988)
      • wAYo.exe (PID: 4688)
      • wAYo.exe (PID: 5072)
      • wAYo.exe (PID: 5064)
      • wAYo.exe (PID: 2644)
      • wAYo.exe (PID: 7996)
      • wAYo.exe (PID: 7924)
      • wAYo.exe (PID: 8120)
      • wAYo.exe (PID: 7568)
      • wAYo.exe (PID: 8016)
      • wAYo.exe (PID: 4932)
      • wAYo.exe (PID: 7260)
      • wAYo.exe (PID: 6132)
      • wAYo.exe (PID: 6660)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 6620)
      • wAYo.exe (PID: 5008)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 856)
      • wAYo.exe (PID: 1672)
      • wAYo.exe (PID: 6028)
      • wAYo.exe (PID: 7308)
      • wAYo.exe (PID: 6136)
      • wAYo.exe (PID: 7888)
      • wAYo.exe (PID: 5328)
      • wAYo.exe (PID: 4000)
      • wAYo.exe (PID: 7876)
      • wAYo.exe (PID: 7940)
      • wAYo.exe (PID: 7732)
      • wAYo.exe (PID: 1056)
      • wAYo.exe (PID: 5324)
      • wAYo.exe (PID: 2240)
      • wAYo.exe (PID: 8096)
      • wAYo.exe (PID: 8036)

    • The process checks if it is being run in the virtual environment

      • MgYMUYIA.exe (PID: 7656)

  • INFO

    • Checks supported languages

      • wAYo.exe (PID: 7636)
      • ZeggggYs.exe (PID: 7676)
      • MgYMUYIA.exe (PID: 7656)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 5392)
      • wAYo.exe (PID: 4756)
      • MgYMUYIA.exe (PID: 4408)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 7900)
      • ZeggggYs.exe (PID: 7336)
      • wAYo.exe (PID: 5048)
      • wAYo.exe (PID: 7348)
      • ZeggggYs.exe (PID: 2152)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 1168)
      • wAYo.exe (PID: 8004)

    • Creates files in the program directory

      • wAYo.exe (PID: 7636)
      • MgYMUYIA.exe (PID: 7656)

    • Reads the computer name

      • ZeggggYs.exe (PID: 7676)
      • MgYMUYIA.exe (PID: 7656)
      • wAYo.exe (PID: 7636)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 5392)
      • MgYMUYIA.exe (PID: 4408)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 7900)
      • ZeggggYs.exe (PID: 7336)
      • wAYo.exe (PID: 7348)
      • wAYo.exe (PID: 5048)
      • ZeggggYs.exe (PID: 2152)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 1168)

    • Auto-launch of the file from Registry key

      • MgYMUYIA.exe (PID: 7656)
      • wAYo.exe (PID: 7636)
      • ZeggggYs.exe (PID: 7676)
      • MgYMUYIA.exe (PID: 4408)
      • ZeggggYs.exe (PID: 7336)
      • ZeggggYs.exe (PID: 2152)

    • Create files in a temporary directory

      • wAYo.exe (PID: 7636)
      • wAYo.exe (PID: 7744)
      • wAYo.exe (PID: 8108)
      • wAYo.exe (PID: 7424)
      • wAYo.exe (PID: 4988)
      • wAYo.exe (PID: 4784)
      • wAYo.exe (PID: 4112)
      • wAYo.exe (PID: 4268)
      • wAYo.exe (PID: 6872)
      • wAYo.exe (PID: 6644)
      • wAYo.exe (PID: 7880)
      • wAYo.exe (PID: 7720)
      • wAYo.exe (PID: 7536)
      • wAYo.exe (PID: 7608)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 6652)
      • wAYo.exe (PID: 8048)
      • wAYo.exe (PID: 5380)
      • wAYo.exe (PID: 5116)
      • wAYo.exe (PID: 5392)
      • wAYo.exe (PID: 1180)
      • wAYo.exe (PID: 4756)
      • wAYo.exe (PID: 7604)
      • wAYo.exe (PID: 7900)
      • wAYo.exe (PID: 4180)
      • wAYo.exe (PID: 5048)
      • wAYo.exe (PID: 7348)
      • wAYo.exe (PID: 7912)
      • wAYo.exe (PID: 1272)
      • wAYo.exe (PID: 1188)
      • wAYo.exe (PID: 6752)
      • wAYo.exe (PID: 6944)
      • wAYo.exe (PID: 7652)
      • wAYo.exe (PID: 7992)
      • wAYo.exe (PID: 5352)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 8076)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 960)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 5360)
      • wAYo.exe (PID: 5972)
      • wAYo.exe (PID: 7816)
      • wAYo.exe (PID: 5384)
      • wAYo.exe (PID: 7412)
      • wAYo.exe (PID: 1040)
      • wAYo.exe (PID: 7368)
      • wAYo.exe (PID: 7712)
      • wAYo.exe (PID: 2040)
      • wAYo.exe (PID: 744)
      • wAYo.exe (PID: 8004)
      • wAYo.exe (PID: 1168)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 7956)
      • cscript.exe (PID: 7580)
      • cscript.exe (PID: 7368)
      • cscript.exe (PID: 3132)
      • cscript.exe (PID: 664)
      • cscript.exe (PID: 7316)
      • cscript.exe (PID: 8144)
      • cscript.exe (PID: 4652)
      • cscript.exe (PID: 8000)
      • cscript.exe (PID: 7700)
      • cscript.exe (PID: 8156)
      • cscript.exe (PID: 3956)
      • cscript.exe (PID: 8076)
      • cscript.exe (PID: 8124)
      • cscript.exe (PID: 1280)
      • cscript.exe (PID: 660)
      • cscript.exe (PID: 7792)
      • cscript.exe (PID: 4880)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 4268)
      • cscript.exe (PID: 2852)
      • cscript.exe (PID: 1616)
      • cscript.exe (PID: 7748)
      • cscript.exe (PID: 6028)
      • cscript.exe (PID: 7320)
      • cscript.exe (PID: 7836)
      • cscript.exe (PID: 5204)
      • cscript.exe (PID: 7532)
      • cscript.exe (PID: 7716)
      • cscript.exe (PID: 1852)
      • cscript.exe (PID: 516)
      • cscript.exe (PID: 1196)
      • cscript.exe (PID: 8032)
      • cscript.exe (PID: 7236)
      • cscript.exe (PID: 7196)
      • cscript.exe (PID: 7568)
      • cscript.exe (PID: 8004)
      • cscript.exe (PID: 8108)
      • cscript.exe (PID: 1228)
      • cscript.exe (PID: 7652)
      • cscript.exe (PID: 8032)
      • cscript.exe (PID: 4620)
      • cscript.exe (PID: 7216)
      • cscript.exe (PID: 7284)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 2908)
      • cscript.exe (PID: 7892)
      • cscript.exe (PID: 7632)
      • cscript.exe (PID: 7640)
      • cscript.exe (PID: 7916)
      • cscript.exe (PID: 1348)

    • Manual execution by a user

      • MgYMUYIA.exe (PID: 4408)
      • ZeggggYs.exe (PID: 7336)
      • ZeggggYs.exe (PID: 2152)

    • Creates files or folders in the user directory

      • MgYMUYIA.exe (PID: 7656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:01:06 00:36:08+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 492544
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
1 516
Monitored processes
1 393
Malicious processes
105
Suspicious processes
141

Behavior graph

Click at the process to see the details
start #VIRLOCK wayo.exe #VIRLOCK mgymuyia.exe #VIRLOCK zeggggys.exe cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK wayo.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs #VIRLOCK mgymuyia.exe cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs #VIRLOCK zeggggys.exe cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK zeggggys.exe cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cscript.exe no specs #VIRLOCK wayo.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK wayo.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK wayo.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs #VIRLOCK wayo.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs wayo.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs wayo.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs wayo.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs wayo.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs wayo.exe no specs cscript.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
208reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /fC:\Windows\SysWOW64\reg.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
472reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1C:\Windows\SysWOW64\reg.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
472\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
472C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\HcsAQYYg.bat" "C:\Users\admin\Desktop\wAYo.exe""C:\Windows\SysWOW64\cmd.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1C:\Windows\SysWOW64\reg.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /fC:\Windows\SysWOW64\reg.exe—wAYo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
51 757
Read events
51 750
Write events
7
Delete events
0

Modification events

(PID) Process:(7656) MgYMUYIA.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MgYMUYIA.exe
Value:
C:\Users\admin\TcQkAsEE\MgYMUYIA.exe
(PID) Process:(7676) ZeggggYs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZeggggYs.exe
Value:
C:\ProgramData\EOUcAIQY\ZeggggYs.exe
(PID) Process:(7636) wAYo.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MgYMUYIA.exe
Value:
C:\Users\admin\TcQkAsEE\MgYMUYIA.exe
(PID) Process:(7636) wAYo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZeggggYs.exe
Value:
C:\ProgramData\EOUcAIQY\ZeggggYs.exe
(PID) Process:(4408) MgYMUYIA.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MgYMUYIA.exe
Value:
C:\Users\admin\TcQkAsEE\MgYMUYIA.exe
(PID) Process:(7336) ZeggggYs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZeggggYs.exe
Value:
C:\ProgramData\EOUcAIQY\ZeggggYs.exe
(PID) Process:(2152) ZeggggYs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZeggggYs.exe
Value:
C:\ProgramData\EOUcAIQY\ZeggggYs.exe
Executable files
329
Suspicious files
6
Text files
207
Unknown types
0

Dropped files

PID
Process
Filename
Type
7636wAYo.exeC:\ProgramData\KiUUYEYs\VcggwQIk.exeexecutable
MD5:5BE93D4B1D0DBC45829EB1249C9F1019
SHA256:AFEECA204A538E8066505ACA3B91F98C7730040001DBC88ED2CA0E921CFAE39D
7636wAYo.exeC:\ProgramData\EOUcAIQY\ZeggggYs.exeexecutable
MD5:7CFF1E6D462241B5C2F7E17899742ACD
SHA256:CBEC2BD3B0756AA98D05939ADEB1663324FD322BB95CE829078E3A8146317268
4988wAYo.exeC:\Users\admin\AppData\Local\Temp\kCwooQkw.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
8108wAYo.exeC:\Users\admin\AppData\Local\Temp\TkUYoQkw.battext
MD5:0B161C962E130DF2A72FF550B999502A
SHA256:BF667CF63F36EB2322EC0BB42CE430089BF6FD6275FBFBCF0631DA3765D93C7B
4988wAYo.exeC:\Users\admin\AppData\Local\Temp\GQUooQkw.battext
MD5:B7A3083E752BB8EDC345957E784003B3
SHA256:2E08EBFEA95A6954273CF4596FA13CA8F654F11521A7168183F69FC9ACEACBA8
7424wAYo.exeC:\Users\admin\AppData\Local\Temp\isIooQkw.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
4112wAYo.exeC:\Users\admin\AppData\Local\Temp\vMYsEwkw.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
4784wAYo.exeC:\Users\admin\AppData\Local\Temp\noUUEwkw.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
4268wAYo.exeC:\Users\admin\AppData\Local\Temp\DGgIUwkw.battext
MD5:38C3C59F059DAEBFB0A0A6AE7CAAB656
SHA256:113DDA670BF437D763DE650DEA7C2F0A946946722ED9CD2E5CA6EF13ADE3E146
4112wAYo.exeC:\Users\admin\AppData\Local\Temp\dKEsEwkw.battext
MD5:3F0FC51FA49232F7AD4ADF708B4A8597
SHA256:3B1ECD0988DDE485A382381036300C3B8131F8CBECD31F53A61697A9A0B6B634
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
35
DNS requests
5
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7656
MgYMUYIA.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
7676
ZeggggYs.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4408
MgYMUYIA.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
2152
ZeggggYs.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
7336
ZeggggYs.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
7656
MgYMUYIA.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
4408
MgYMUYIA.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
7676
ZeggggYs.exe
GET
301
216.58.206.46:80
http://google.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7656
MgYMUYIA.exe
216.58.206.46:80
google.com
GOOGLE
US
whitelisted
7676
ZeggggYs.exe
216.58.206.46:80
google.com
GOOGLE
US
whitelisted
2104
svchost.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2104
svchost.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4408
MgYMUYIA.exe
216.58.206.46:80
google.com
GOOGLE
US
whitelisted
7336
ZeggggYs.exe
216.58.206.46:80
google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
7676
ZeggggYs.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7656
MgYMUYIA.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7656
MgYMUYIA.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com)
4408
MgYMUYIA.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7336
ZeggggYs.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
2152
ZeggggYs.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7656
MgYMUYIA.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
4408
MgYMUYIA.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7336
ZeggggYs.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7336
ZeggggYs.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wAYo.exe