100
Malicious
This predictive confidence of maliciousness for this sample is 100%.
d79e4c4ceb3abc8a51a01eff14a51694d7c25f9306ee71a922a01fddb48a15fe
1.7 MB
2020-10-08 00:38:18
First seen 36 days ago
Windows PE32 Executable

Classification

Full Detail
Ransomware
High
Trojan
High
Virus
High
Banker
Low
Bot
Low
Rat
Low
Adware
Low
Infostealer
Low
Worm
Low
Spyware
Low

Indicators

Expand All
DeepView™ Indicators
Forced Code Execution
Automatic Sequence Detection
Program Level Indicators
Anti-Av
Disables Windows Security features
Anti-Sandbox
A process attempted to delay the analysis task.
Av-Tools
This sample is detected by clamav as: BC.Win.Virus.Ransom-9157.B
One or more AV tool detects this sample as malicious: Trojan:Win32/NabucurObfs
Dropper
Drops a binary and executes it
Generic
Sample writes a large amount of files (Over 100)
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Creates executable files on the filesystem
Expresses interest in specific running processes
Reads data out of its own binary image
Attempts to disable UAC
Automatic Sequence Detection maliciousness score: 56%
Http
Performs some HTTP requests
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Network
Sample contacts servers at uncommon ports
Performs some DNS requests
Packer
Allocates read-write-execute memory (usually to unpack itself)
The binary likely contains encrypted or compressed data.
Persistence
Installs itself for autorun at Windows startup
Program-Level-Features
Contains obfuscated control-flow to defeat static analysis.
Service
Creates a service
Static
This sample contains high entropy sections
Stealth
A process created a hidden window
Deletes its original binary from disk
Attempts to modify Explorer settings to prevent file extensions from being displayed
Attempts to modify Explorer settings to prevent hidden files from being displayed
image/svg+xml

Yara

Yara Pattern Name Description
IsPE32 No Description Available
ImportTableIsBad ImportTable Check
HasRichSignature Rich Signature Check
image/svg+xml

MITRE ATT&CK®

Show ID

Static Analysis

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x001a1292 0x001a1400 7.15068138242
.rsrc 0x001a3000 0x0000115c 0x00001200 5.52354564259

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x001a30a0 0x000010a8 LANG_ENGLISH SUBLANG_ENGLISH_US Device independent bitmap graphic, 32 x 64 x 32, image size 0
RT_GROUP_ICON 0x001a4148 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US MS Windows icon resource - 1 icon, 32x32

Strings

  • !This program cannot be run in DOS mode.
  • Rich!4O
  • 7\PJ6S
  • 5f7Sn@
  • &79G"7\PV6S
  • &79G"7
  • ].S_Szy
  • .S~BwSy
  • K7d676DPK
  • /47f;l:do
  • $VPmQt;
  • i~}OI7,
  • @NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIO@NIOFK
  • @`N|Ot
  • IO@{Hz@{I{@NIo
  • `Naz@z7@`
  • AiO#MIl1
  • @NIzA{Iz@zIO@
  • ,D~|Ot0Fo@
  • u.~|Ot0Fo@{J{
  • p{I{>AiO
  • `N}OOnI
  • Fo@{Iz@{Iz@{Iz@z
  • @`N}OOn
  • 7>dZvZgn
  • fk(Bdk5Be
  • dk9Cek1Cfk-
  • fk+@dk7
  • U:gQK/
  • icsSK;wr
  • <>H;gl
  • %PKkoF
  • W:gRKk
  • `3SK;s
  • xRK;gC
  • UgSK;s
  • g8gR_B
  • +9gP["
  • $fSK;w
  • Z~"^jk
  • %g{Eg+VK;gxEg
  • VK;gzEgsZK;;i
  • XK;3QK
  • *o (&C
  • $fRK;7
  • `Xzj.\
  • $fSK;w
  • W:gSKkOC
  • {EhWI6
  • ~C^#k+.
  • T:gSKko
  • X>dhTcSSK;
  • rbI"wD
  • C"ZHsC
  • JW:gSK+V=
  • 8(?&H;g
  • DkKDro
  • Ng[RK;7
  • V:gPK/
  • `4)fz97u
  • |>4u7:
  • L>4uO.
  • ak-4t[/
  • a_.5t?L
  • XRh|kk[G>
  • w&UOhT&
  • ~'R:M+
  • ="<<gR
  • +"VW%7
  • T:gRKk
  • bhVK;g
  • ~_dWR/
  • V:gPK+
  • bI;gAR
  • eSKg7RK;7`X
  • Rc/SK;
  • RcE;jB;g
  • +%fSK;w
  • >?rH;g
  • W:gPKc_QK;_
  • 'fSK;w
  • ;dQKk'A2
  • SK;sZ6
  • `^tVoSK
  • C+*c*-
  • <bI;gNJ;gQ[rZ
  • NJ;gQ_^
  • `Hc7RK;
  • 8?RH;g
  • :WhG'A
  • _+2y;w
  • V:gRK+
  • =6I;gb
  • rfa?dj
  • N^_bWUJ/J
  • !7*W:gQK+
  • [@8\FU
  • \FUt&vHo
  • Uy:DUx^8X
  • G[jas`|KFV<S
  • [+j";=;
  • XpCh5c
  • V:gRK/
  • \v]-Jk
  • V:gQK+n
  • 578LrI
  • OyG+~@
  • VJ;;*A;g
  • SK;{RK;gFr;
  • R5-]47
  • HTI`Ib
  • "]-[<3
  • )(;j}e(
  • 5(9j}M
  • 4CPl1M;_g
  • 7V<tdA
  • nhB(jL\
  • 'Ju6Hm
  • CWZD.(
  • KB2T|Q
  • }>!HUHo8
  • 6I)a!K?G
  • Tqc/
  • eA8BQ5
  • |?g+4d
  • |?g+4d
  • |?g+4d
  • |?k+4d
  • |3k+4d
  • |3k+4d
  • xH7')q
  • x&C_%B/6
  • fi\%CG
  • x%c/dt5
  • A_-v7c
  • CAp@}Q
  • {Q`T!e
  • U!e1o'CE
  • (dn_VaT~
  • MQy9c[
  • {Mdtm!
  • 3um!1s/
  • #HjORDu
  • 4NrBV8
  • &9`g2
  • YpHi*j
  • 33xfCZ
  • Su5Llx
  • (g+&}g[
  • O,aji$(
  • w5F5$9q
  • .&Pc/m
  • , ]&)R
  • ,_u:[Iz
  • b%8H{Z
  • f</8Y\!.
  • $6Ck0I
  • <bVU&8k
  • }yY<}$
  • `^=%4`6n
  • EXMz^g
  • S6J]LJ^
  • `E4=u2
  • q69A(|D
  • A6UtHY
  • uzF..H
  • N$Cj-$`cR
  • NJ?61j+
  • @wLa|~
  • 4tT)"n{
  • cb=4pKj
  • (el\Rv
  • DcL} "
  • v3}vm)
  • n@A(Z,
  • B= l&b
  • 3q6n=L
  • -vV*.L3Q
  • LO@u$"
  • f:hn:n
  • &vV`;'
  • XZNz+A6
  • ;*x3Vn
  • y9X|P1n
  • )4`L-^~
  • ib?6$*
  • yV|%@a
  • [Ux]&n9&P;
  • alpNN
  • L}u>s1
  • QTY^fa6PS<
  • 'DD>V~
  • p>77$Qf
  • 6SD2C>iQ>
  • ;COz|>
  • 5Y$|X)j
  • m=wf*xb
  • 'f":x{B
  • <exX^zZF
  • Q@%:2*n
  • 7Hp2Zj
  • :SEj"m@
  • XzRzO52
  • ^Ze|,kg>
  • vnQ[C.
  • i?^-T!,^=
  • :.J@_
  • 7S;L}{Rd
  • mFgEQ=
  • ryx\oV
  • cU?7Zq
  • Yj?Z%}J
  • Q|@5V~
  • 8}|DRB^
  • .6@#f9
  • n,\U&3
  • ERmx2-N
  • &q^My0
  • +lqFQUp
  • Zu]]8]A
  • *=$WSJ9
  • !d,RZ/
  • i`r0<<
  • V5FPUT
  • GlU>Q]p!8
  • vAqAZM
  • @|OZ-5d
  • v{n<y2
  • 2!&r.E
  • Jh5N6!
  • &,hqRN
  • LbfyTz
  • UvQ{/2)
  • b}[v|Pm
  • N"=Vcn
  • _sp-JV=
  • ]7na0i
  • BY%Dy6
  • EEajEs
  • Qf*1wC
  • ,EqUbE
  • YHy,~=
  • 3L}za
  • zUTUXB
  • $oril`+v
  • Izm-:1
  • NQHidf
  • "6r,xU&
  • zyle$n
  • Pb 8Q.'
  • iF~B5,
  • ~P}Hv!
  • nj1|-vv
  • vqzk*X
  • &vB)|*
  • m>JN-X
  • mj}Q)Y9
  • A>FR1\
  • QJra9c
  • unB15#
  • BFQp!*Y
  • 2v~!t2
  • 6_;m~;
  • in9N8qt
  • i1=bi4c
  • |} Qij~
  • MgDfA:
  • mZ-o^
  • *eMJ16
  • i1aR=Z
  • Va^#vP
  • j$`Q>^
  • -uV-(B
  • FV%Tiv
  • QEv(x4
  • ">=6NJ
  • BB]Tanr
  • $?m*.%
  • KZH%1a
  • 6J&dCs
  • f>n,:K
  • BN<?WS
  • BYKs:d
  • T473"R
  • +M)4]m
  • )<;U)0
  • fs~h+gO
  • JO+8I+/)
  • *8K?.,B
  • w2nTJK
  • xa%{m*O
  • 9Sg2`vN
  • ~c{A*+
  • ZVaJ~
  • }U|t]5
  • Aq774!9
  • #Q&AlT7
  • i#kvQ^
  • imp>1g
  • f>oL[k
  • f}L=Uc%
  • ayi>}6:y
  • E&:zwU6)
  • Uc%I\b
  • `%x9 X
  • )-x,Qm
  • 'zPKn]
  • p1yK-5
  • ~GI:(v-
  • W8H)2c
  • 2ZR03F
  • "FsEVM
  • <K5^I0
  • &&it5Qg)
  • G5Fce-
  • Z+oa"K
  • .VJ\[
  • W9d*AY
  • n?JjzeP
  • N#k}z_QA
  • 92^*5o?:l
  • `c&s3!
  • s}jr k
  • ^.&Ur,
  • -aPQeb
  • AV!a(}+
  • s!<l-C
  • S8]cNR =|
  • eaT#?6
  • 1/[ATX
  • YB-Ua9
  • !F]f)}
  • YJ)Ua9
  • ]fI)^j
  • UvYB1M)
  • I")Ui=
  • dCr+;;^k[g
  • [+rS!?
  • NJ;gR_
  • NJ;gR{
  • 8?2I;gT
  • Fc'SK;s
  • SK;s&M"`
  • Lc;SK;sZ
  • gfQKkoNJ;gQ[2
  • Y)+rNI;7
  • NJ;gS_
  • 2C*?>H;g
  • :,{`SK
  • $fRK;7
  • :RK;7e
  • SkONJ;gQ[
  • Ji'fRK;7J^&
  • 9gQ_RA
  • SK;sV?
  • ~L+6#c8s
  • D;{RK;gF
  • +qR_+5
  • &mJG#m
  • dU_8=
  • $fSK;wn\
  • vz*;7#q
  • NJ;gP[V3
  • >"Y[V!8Hg
  • k9gRW:gQKc
  • RK;7QZ
  • QU">oT
  • QU">oT
  • QU">oT
  • QU">oT
  • QU">oT
  • QU">oT
  • jhQ}a
  • jGjQ}a
  • jhQ}a
  • jhQ}a
  • jhQ}a
  • )>0a|)
  • )>0a|)
  • jhQ}a
  • jhQ}a
  • jhQ}a
  • :=f >Nd
  • )>0a|)
  • :=b!>oT
  • :=b!>oT
  • :=b!>oT
  • :=b!>oT
  • (>0a|)
  • :=b!>Nd
  • jhQ}a
  • )>0a|)
  • (gT2Ja
  • (>0a|)
  • {|)Q}a
  • :=b!>Nd
  • {|)Q}a
  • )> f|)
  • o|)Q}a
  • jhQ}a
  • )> f|)
  • {|)Q}a
  • ?@<|)8
  • <$3|)i
  • $fSK;s
  • s9gP_b
  • 00Kk3F
  • $fSK;s
  • GgoSK;s
  • .9gP[z7
  • zRK;gE
  • T:gQKk
  • TcSRK;7
  • ~7ZC@/
  • 3%fQK;W
  • A[nRgP/
  • ,AWC=d
  • Rk;B27
  • yRK;gF
  • K>w:;y
  • Xn-*k?
  • XzqqQk[
  • 5'{RK;g
  • FHBc?SK;
  • pD*5S]C
  • _r#UOk{F
  • SkWNJ;gS[
  • {RK;gEn~
  • S8gS[N
  • X.hR]k
  • ZD'fSK;sZN
  • `{SK;s
  • ;$fSK;sz2
  • =LccSK;
  • zG6LG3x]B
  • $fRK;7
  • IcWSK;cq
  • oSo}@]
  • X&BMGk
  • W:gSK+
  • (?^I;g
  • ig?SK;w
  • xRK;gF
  • Pq_jOnW
  • YNH|NkC
  • Z'fSK;sV
  • {9gQOf
  • )?*I;g
  • {RK;g`
  • .a;7rv
  • <.I;gC
  • 8O>B;g
  • "B;gRcfnPK;O
  • suQKc{[K;
  • U:gQKksD
  • 3v>2wv
  • Ks*D6n
  • #_O+*S
  • \Zu?Ec
  • T:gQK+
  • <nH;gA
  • 4dOI,l(H
  • \eOI,l(H
  • p"yL`C
  • Ok{Azh
  • cv.}CzIB
  • T:gRKk
  • (?.I;g
  • FR/;7=
  • -v~89?
  • \*{CN+
  • /Bbm=7
  • %fRK;7
  • Q_62QPk7CB
  • $]c7RK;
  • \:d0X/
  • @]7IYf
  • Cjv@Jl
  • Bvr_FI>]k
  • NJ;gS[
  • ]cOSK;
  • tf]Fz@6J
  • g($yo(
  • (PQ{?|
  • q2D@ZQ[DCp
  • NJ;gS_.:6Y+
  • '?zI;gAR
  • 7?bI;g
  • $fSK;wB
  • Y&C}]k
  • K=bI;g
  • 6?vI;g
  • Gr_&Gw
  • @^|k]SR
  • T:gRKk
  • I;gGBq
  • ht)PoH
  • Vk[_&V
  • #xRK;gCF
  • 9gS[2m/Fk
  • <:I;g@B
  • @c{SK;
  • gq"oOKh
  • dkRK;7
  • W:gQKk
  • {9gS[v@
  • C{RK;g
  • %fQK;W
  • A><ZXw
  • Q0#e.2y
  • NJ;gQ_
  • ~3j,j+
  • $=p.+C
  • Ua<dci
  • NJ;gQ[
  • `+SK;c
  • NJ;gQ_
  • l+JkSE
  • +:JI;g
  • OxRK;gD
  • `gSK;s
  • 37?RH;gF
  • pB6]wA
  • %fSK;s6o
  • \.22hk+I
  • &'7-[V
  • T:gQKkk
  • MkgCb!
  • Lgoft{y^
  • 0uGRF&O
  • S$fQK;W
  • XB~oZ/>b
  • '`gRK;?
  • H;gBfF
  • 6{4Kko
  • Xb7|Vc
  • 2w.xFjA
  • &-\C r
  • {RK;gc
  • B]R JR
  • +zWL=w
  • T:gPKc7SK;
  • .?nI;gI
  • Xb9hh+
  • kL=#4Hs
  • s8X2e|
  • NJ;gQ_2
  • (?^I;g
  • 7`\&DpTcKPK;
  • 0U@"L._[
  • ;&fSK;s
  • {S-08R
  • T:gRKk
  • .?NI;g
  • ~[w9k/B+-
  • zY|g&
  • ~BJ@^_N6
  • $fSK;s&
  • Q;jxI+j
  • +xRK;gc
  • 4?^H;g
  • ufkhu&IM`
  • zN/U+
  • DBi}TOrp
  • _"~qMk
  • 'fNJ;gP[J
  • NJ;gP_6
  • W:gPKk_
  • SgPK/j
  • 1VX'fRK;7
  • NJ;gS{
  • <:I;gC
  • dRK;gQ
  • >w^C3oYC
  • t^C3oYC
  • :t^C3oYC
  • t^C3oYC
  • (kZC3oY
  • X7oZC3o
  • BG3oYC3
  • t^C3oYC
  • x8w^C3oYC
  • X7oZC3o
  • VX7oZC3o
  • V[7oZC3o
  • TV[7oZC3o
  • tV[7oZC3o
  • [7oZC3oI
  • xRK;g@
  • ceQK?6g
  • ha\Rza
  • mnsOMAU
  • NSOMmQM]
  • >MW/k{
  • sBi"Xa
  • maqjb^E
  • 9ZWPpr]Y
  • n^EsNIs
  • iGk?GF
  • {RK;gGv
  • .?L).s
  • .?L).s
  • .?L).s
  • .?L).s
  • .?L).s
  • .?L).s
  • .?L).s
  • $fRK;7I
  • e>{RK;gD
  • ]/.>#=7
  • fSK;sy
  • YPURLXd
  • |$sj<]o
  • XPrGBD
  • 'fSK;wZu
  • l&]BQGk
  • :::;jJ;gG
  • {eSK/b
  • aU>Sl>?
  • cCp[r_
  • oxRK;ga
  • eQKk_D&
  • `WSK;w
  • T:gRKk
  • Tc/SK;s
  • f@nDPBCp^
  • $fRK;7
  • }sCWK;
  • $fRK;7
  • {MGG*;
  • $R-i"'-
  • "&-n" -m">-r"|-i"?-{"
  • "R-="R-#"R-;"R-;"R-
  • C`]-,*R
  • 30T,A6Ra"9}C
  • :@y!T!
  • {J-hfd
  • M:Qp)$
  • Lt)h>Ri8
  • ?S-07Pv*%/
  • B8+,A3'1YL*"
  • Pt.Q?R
  • pmF-55Qa
  • r-81W=
  • 5@5/)B00`
  • ]8*;@>[9S
  • xO/_>Sr
  • cW)B3;t#
  • aY1#as
  • tWF=1+
  • UV'*d3
  • Nt(N?[
  • J)B8Pp+&:
  • U`+)p:
  • aH*K:V
  • Xq(+x8S*SyU
  • G)F=Y^,$3
  • `GFE-X9Wf
  • r[R6+#
  • Qz-wZ&
  • tocH9
  • 8rP8,
  • Vr!;u8
  • .\#4JiLk
  • [:CCJ#
  • PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD

Dropped Files

1a3b9bc2d4b6ffe5_csEs.exe

Name
1a3b9bc2d4b6ffe5_csEs.exe
Size
5.5 MB
Type
PE32 executable (GUI) Intel 80386, for MS Windows
MD5
4207a436a77ffffcda360ce3f71afca3
SHA1
73e654dc992f281890c1465a73a2c0d54f8a48c2
SHA256
1a3b9bc2d4b6ffe575d3c24fa329b9b82be09732f1fddaaec68e7fb1d1be5b7e
SHA512
5552d4f3584eeb534850ed63eff8a84c8293e31561014d417c185ec4bcfe28beca2ca53f80f130d82099c6ae80f1b8f0b5f2adca2562f4cccff54dd08f5e271a
Ssdeep
49152:hVV8REgHYCNB0fOT1lewWI2odFW3zs6fSl3SMzgpu6k3O2vvTs3BxVnU2k1fb/O7:hARv3N31C7q3w9F06k3OWpUwHFu1

3086136e6add3b14_okEU.exe

Name
3086136e6add3b14_okEU.exe
Size
1.7 MB
Type
PE32 executable (GUI) Intel 80386, for MS Windows
MD5
1fdd64fe766f04e26db2c321f09374da
SHA1
6f4bf13dd90483ef8008ca53d75d286cc5c13fa5
SHA256
3086136e6add3b14a13d08be15f142b57027cf6155baf2298e141c72f029a9c1
SHA512
0dae920b48ad290e79690c63ff4f7fcc3c20777b571136a056d30f93658341a923d12092a72f2b80edc1d1e7a68353754e0302a98cbebae86086cbfa46c97368
Ssdeep
24576:kmrX1S1U8plLpTjlp1GyAP0+tx68yL0iioLjxTTeSDMlNX2:f78pTOhuBLjl/M6

329a60c502f0b1fd_FIEq.exe

Name
329a60c502f0b1fd_FIEq.exe
Size
1.7 MB
Type
PE32 executable (GUI) Intel 80386, for MS Windows
MD5
7b7190fa064cc6d3b2a441a7ab6bb9fc
SHA1
8d2f5d3cb1404d55d771e3b6690e01c69b5f33e9
SHA256
329a60c502f0b1fdcdf79be42e549166b60a52dd947890c155b6e5b15a16f50b
SHA512
72aa974f539ac035dedb9f3a4adaea5ba9d3c9761851fb64d29c3ada851649092a395b21555120cd948eabe511ebf2dd17bc7973909f051c8d644ad5c030ef48
Ssdeep
12288:LvyXoTrhbPh2XYKX93xdNlEj18MdVuIehJpMC7vhBu1+urC4dkX:L6X8FV2tXtxdN2j68VuN5MQvDuMiLy

56ba6f8eef5318f5_fkQs.exe

Name
56ba6f8eef5318f5_fkQs.exe
Size
1.7 MB
Type
PE32 executable (GUI) Intel 80386, for MS Windows
MD5
a4eb01c7ac9015498caa42b512da8e59
SHA1
1316b123fdc2ec699b1a3dd75239293a8c3ee417
SHA256
56ba6f8eef5318f5cd2a45b216fe5ce1a01dac9c0d3f6b27e4e3097f08d2b811
SHA512
9dadae477d5b73781a350782c48cdf6aadb79fd1fbf950d3a7fc957905d37f460efa2870f8328be145f8c65595c8c84b070d26e3049a330e934dbcb63d74987c
Ssdeep
12288:gW5L/Apu8zY5XFJsz7oUWP2BkldKQyiQUKP9qL7/Zmj6Edvxx1Za:gXu8zY5X/M7oOBeKUMPyDCvxZa

69512f978f4b50f8_wwcY.exe

Name
69512f978f4b50f8_wwcY.exe
Size
1.7 MB
Type
PE32 executable (GUI) Intel 80386, for MS Windows
MD5
2221adf6395572c11200915c8079c59b
SHA1
83e6f6fa019abd1b236802ab10b2e383a28c17a5
SHA256
69512f978f4b50f8c4f4a7624a60e20c67f2ce0e6c8cf0393f78af682e3cdf18
SHA512
4ba2d5bd192cc5bed26cad6bb371cefb94c80ae941968daa2dcdbfe018706671186247c351695e15c0e4b4ae36c5ec7b455e588c2999d5a851958d7d765f61fb
Ssdeep
24576:Ctg0Bp79ei2Lqt8Rfcn1wAFWv9o1jddWbhtczTp/wiCiph+2ax7KLt1zUkUQnsu:+geQvmdrNBUq

7545bc0a7f039905_LEME.exe

Name
7545bc0a7f039905_LEME.exe
Size
6.9 MB
Type
PE32 executable (GUI) Intel 80386, for MS Windows
MD5
070dd77feadaf6b6597e9fa82d98a17a
SHA1
737899a9545a9b51a5f9981379572a51500a0de1
SHA256
7545bc0a7f03990587da8301c77b241e988e4a94355b3c46cecce74edd93a939
SHA512
fff843f7a0c9a8923129a5db7a458e5b3ddec09471bb12f90a7b8a5a822dc171c39cf2e7d02859f3d3b921e31aa18fe0ab61534a072b1b5d11fdaeb047600a42
Ssdeep
98304:iOaEuE1duhPop81aiYE0yeaeIg7GFX50cq5HRORndf413JwoNFTdpRPUP:nz2oeDeeyxnJvA

76e8f72f7353a063_SowG.exe

Name
76e8f72f7353a063_SowG.exe
Size
17.7 MB
Type
PE32 executable (GUI) Intel 80386, for MS Windows
MD5
bc8cb5b4b26cf989bde3158fbdd28ad0
SHA1
65f60e655d99062d88d092b6eba30ab9e9c72dfe
SHA256
76e8f72f7353a063f86417aeb861b07c9e6edbe58e79a78e3b324b93c36ca480
SHA512
8869b8e8c3f9c4744527eb58ae92da901a18a24068393da95a95749d11fbd377e1490453b87a3b012397fbddef066cedf87047988fa88ea96a8756e3aaf26c68
Ssdeep
196608:v9u9zq6k8QJ51IBJapDJB4YurkbbJjkzCoSS2IgzOXvPgp2riYGnPhvZUUvOFi:v9S651IBEM1A6HUOXvPjriYGPhBoFi

a051ae5af2f7c99d_EgAs.exe

Name
a051ae5af2f7c99d_EgAs.exe
Size
1.8 MB
Type
PE32 executable (GUI) Intel 80386, for MS Windows
MD5
5c690074cb273ae0f0424b5dbc3e1f3c
SHA1
214b15dbfbb4ee85617013b2748d9181f8989ce4
SHA256
a051ae5af2f7c99dd8b0224f36aad345c911a4a008b166959876cc0a0c1d8907
SHA512
ec71e7f71b73c9adab77b2148a1d00c99b47fad7b6388118cc8902ae1a2d51980e40e93503a12ac7d799f5f277a78c13f5cc2814579816169b9c68e1bbd3b6b5
Ssdeep
49152:5ChjHAe1Vw43RpoQ9n8+dXRvSRw008+3Y:whjHAe1Vw43RpoQx8kRO08R

a4512bd195ccb0ac_kQMI.exe

Name
a4512bd195ccb0ac_kQMI.exe
Size
1.7 MB
Type
PE32 executable (GUI) Intel 80386, for MS Windows
MD5
aed5cfe12b049cf370b725973e3ec623
SHA1
06c920e4f696423a7c72ed353ac49fd8e479f6c2
SHA256
a4512bd195ccb0ace091d68116793c919790702da97faec69ae79ef01a03a90c
SHA512
ab720d3ef941febb5743cd75a4fbc6343c267e6a1f718a35ab6df27eee66d0a60049a17a1cab87a9385c97071fab6f190e5424efd4e25649813df58ff42d75a2
Ssdeep
12288:zUxSur14sgrRhiggVuue/mwMuuxrbF0Mz959hX4RixlaJ9UEG:ggpbrDigqwIxB0u3cixlaJ9C

aac7febf21ed2509_wkEo.exe

Name
aac7febf21ed2509_wkEo.exe
Size
1.8 MB
Type
PE32 executable (GUI) Intel 80386, for MS Windows
MD5
29cbb529d1a42c166b3c16c4dec02e74
SHA1
e8b5268ca6641e8f5ad6e6273fccb4e76ff6ddb1
SHA256
aac7febf21ed250976d371d06f2053e2d9d1dda093c079ed66bf19c4639036e8
SHA512
965ad14148a567777008abf24e2eda8c75426db6d3b48163cebc96ec633ec54c51cea7c4c64eb7f73d041f14f52f047a0e13d941ecad5411fd733e45f947d417
Ssdeep
24576:01zZYcNns3I5DB2XjeGEdLIlMtoYltiO3t:SNs3BKG8LIetocti0

d79e4c4ceb3abc8a_d79e4c4ceb3abc8a51a01eff14a51694d7c25f9306ee71a922a01fddb48a15fe.exe

Name
d79e4c4ceb3abc8a_d79e4c4ceb3abc8a51a01eff14a51694d7c25f9306ee71a922a01fddb48a15fe.exe
Size
1.7 MB
Type
PE32 executable (GUI) Intel 80386, for MS Windows
MD5
302943c5d332a88c3c383e6f645c9be4
SHA1
11266d318da6cab6df2284e5c8068039442cd0e0
SHA256
d79e4c4ceb3abc8a51a01eff14a51694d7c25f9306ee71a922a01fddb48a15fe
SHA512
f8e8df1a4b1dcb84bf4a2666e946bed396c18341ee4137a9300708315be8b466b28dedb78ca05a22cfc6b71ab6f148087925e045565a551d83124305162e1f52
Ssdeep
24576:s4dzA+UfEuE42rvECKMsF/y8jXXwhvRQ3:sgNPuE42YPMsF/ymQhu3

Network

DNS Requests

Domain IP Address Destination Location
google.com 172.217.13.78 US

HTTP Requests

http://google.com/

GET / HTTP/1.1
Host: google.com

Hosts Involved

IP Address Country of Origin
200.87.164.69 BO
200.119.204.12 BO
172.217.23.174 US
190.186.45.170 BO

Geolocation

Destination Country

BO:
60%
US:
40%
AfghanistanAngolaAlbaniaAlandAndorraUnited Arab EmiratesArgentinaArmeniaAntarcticaFr. S. Antarctic LandsAustraliaAustriaAzerbaijanBurundiBelgiumBeninBurkina FasoBangladeshBulgariaBahrainBahamasBosnia and Herz.BelarusBelizeBolivia Percent of Connections: 60%BrazilBarbadosBruneiBhutanBotswanaCentral African Rep.CanadaSwitzerlandChileChinaCôte d'IvoireCameroonCyprus U.N. Buffer ZoneDem. Rep. CongoCongoColombiaComorosCape VerdeCosta RicaCubaCuraçaoN. CyprusCyprusCzech Rep.GermanyDjiboutiDominicaDenmarkDominican Rep.AlgeriaEcuadorEgyptEritreaDhekeliaSpainEstoniaEthiopiaFinlandFijiFalkland Is.FranceFaeroe Is.MicronesiaGabonUnited KingdomGeorgiaGhanaGibraltarGuineaGambiaGuinea-BissauEq. GuineaGreeceGrenadaGreenlandGuatemalaGuamGuyanaHong KongHeard I. and McDonald Is.HondurasCroatiaHaitiHungaryIndonesiaIsle of ManIndiaIrelandIranIraqIcelandIsraelItalyJamaicaJordanJapanBaikonurSiachen GlacierKazakhstanKenyaKyrgyzstanCambodiaKiribatiKoreaKosovoKuwaitLao PDRLebanonLiberiaLibyaSaint LuciaLiechtensteinSri LankaLesothoLithuaniaLuxembourgLatviaSt-MartinMoroccoMonacoMoldovaMadagascarMexicoMacedoniaMaliMyanmarMontenegroMongoliaMozambiqueMauritaniaMauritiusMalawiMalaysiaNamibiaNew CaledoniaNigerNigeriaNicaraguaNetherlandsNorwayNepalNew ZealandOmanPakistanPanamaPeruPhilippinesPalauPapua New GuineaPolandPuerto RicoDem. Rep. KoreaPortugalParaguayPalestineFr. PolynesiaQatarRomaniaRussiaRwandaW. SaharaSaudi ArabiaSudanS. SudanSenegalSingaporeS. Geo. and S. Sandw. Is.Solomon Is.Sierra LeoneEl SalvadorSan MarinoSomalilandSomaliaSerbiaSão Tomé and PrincipeSurinameSlovakiaSloveniaSwedenSwazilandSint MaartenSyriaChadTogoThailandTajikistanTurkmenistanTimor-LesteTongaTrinidad and TobagoTunisiaTurkeyTaiwanTanzaniaUgandaUkraineUruguayUnited States Percent of Connections: 40%USNB Guantanamo BayUzbekistanVaticanSt. Vin. and Gren.VenezuelaVietnamVanuatuAkrotiriSamoaYemenSouth AfricaZambiaZimbabwe89%78%67%56%44%33%22%11%0%100%

File

Type
PE32 executable (GUI) Intel 80386, for MS Windows
CRC32
3E24D3A8
MD5
302943c5d332a88c3c383e6f645c9be4
SHA1
11266d318da6cab6df2284e5c8068039442cd0e0
SHA256
d79e4c4ceb3abc8a51a01eff14a51694d7c25f9306ee71a922a01fddb48a15fe
SHA512
f8e8df1a4b1dcb84bf4a2666e946bed396c18341ee4137a9300708315be8b466b28dedb78ca05a22cfc6b71ab6f148087925e045565a551d83124305162e1f52
Ssdeep
24576:s4dzA+UfEuE42rvECKMsF/y8jXXwhvRQ3:sgNPuE42YPMsF/ymQhu3
PEiD
None matched

Screenshots

Behavior Summary

File-Read

  • C:\ProgramData\FeUgYgUs\geoswEAk.inf
  • C:\Users\Virtual\AppData\Local\Temp\AeYoUoQg.bat
  • C:\Users\Virtual\AppData\Local\Temp\BUMEUMUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\CMooAEsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\DmocgkIA.bat
  • C:\Users\Virtual\AppData\Local\Temp\GGEMMsEc.bat
  • C:\Users\Virtual\AppData\Local\Temp\GygQIsQQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\HywEUMYo.bat
  • C:\Users\Virtual\AppData\Local\Temp\JGQkwEYE.bat
  • C:\Users\Virtual\AppData\Local\Temp\JaUEUkIQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\LIcoUIMs.bat
  • C:\Users\Virtual\AppData\Local\Temp\MKgAgcMQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\NCcggEQw.bat
  • C:\Users\Virtual\AppData\Local\Temp\POYMogwc.bat
  • C:\Users\Virtual\AppData\Local\Temp\RskcAIUQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\TSgAoEcU.bat
  • C:\Users\Virtual\AppData\Local\Temp\TyYIYQMo.bat
  • C:\Users\Virtual\AppData\Local\Temp\UWMoIsQI.bat
  • C:\Users\Virtual\AppData\Local\Temp\UgwMEgYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\UswwkoUE.bat
  • C:\Users\Virtual\AppData\Local\Temp\WEUEEosE.bat
  • C:\Users\Virtual\AppData\Local\Temp\XSwkwEsY.bat
  • C:\Users\Virtual\AppData\Local\Temp\Yggskowk.bat
  • C:\Users\Virtual\AppData\Local\Temp\YqAkkUoQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\ZusAMoco.bat
  • C:\Users\Virtual\AppData\Local\Temp\bUAgwoYc.bat
  • C:\Users\Virtual\AppData\Local\Temp\bqAMMwYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\bqMYIwEM.bat
  • C:\Users\Virtual\AppData\Local\Temp\dAEokQoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\eOgwIUUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\eyUMMUEA.bat
  • C:\Users\Virtual\AppData\Local\Temp\fGgwEAEg.bat
  • C:\Users\Virtual\AppData\Local\Temp\fagwEogU.bat
  • C:\Users\Virtual\AppData\Local\Temp\file.vbs
  • C:\Users\Virtual\AppData\Local\Temp\hSAYgIco.bat
  • C:\Users\Virtual\AppData\Local\Temp\jEcwwcYM.bat
  • C:\Users\Virtual\AppData\Local\Temp\jGAIEwIw.bat
  • C:\Users\Virtual\AppData\Local\Temp\juMYMEUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\kCAIkUoM.bat
  • C:\Users\Virtual\AppData\Local\Temp\kiIYkIsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\koIEwAsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\koggEUEo.bat
  • C:\Users\Virtual\AppData\Local\Temp\kowwQIAA.bat
  • C:\Users\Virtual\AppData\Local\Temp\lWkUkEkc.bat
  • C:\Users\Virtual\AppData\Local\Temp\oQoMYoUo.bat
  • C:\Users\Virtual\AppData\Local\Temp\qswMgoQU.bat
  • C:\Users\Virtual\AppData\Local\Temp\uAgUcwoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\wQAMAscY.bat
  • C:\Users\Virtual\AppData\Local\Temp\xCwIYsAo.bat
  • C:\Users\Virtual\AppData\Local\Temp\yCkIEIIM.bat
  • C:\Users\Virtual\AppData\Local\Temp\yakQUEIE.bat
  • C:\Users\Virtual\AppData\Local\Temp\ykgAgQYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\yqwkkcoc.bat
  • C:\Users\Virtual\AppData\Local\Temp\zEoEswoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\zwkYkQkE.bat
  • C:\Users\Virtual\qOUwQcUU\DUckIoEY.inf
  • C:\Windows\SysWOW64\cscript.exe

File-Written

  • C:\ProgramData\BaYccoIY\CAMIMsAM.exe
  • C:\ProgramData\FeUgYgUs\geoswEAk.exe
  • C:\ProgramData\FeUgYgUs\geoswEAk.inf
  • C:\Users\Virtual\AppData\Local\Temp\AeYoUoQg.bat
  • C:\Users\Virtual\AppData\Local\Temp\AqQAYUEI.bat
  • C:\Users\Virtual\AppData\Local\Temp\AyoUUUEg.bat
  • C:\Users\Virtual\AppData\Local\Temp\BSgIAwAw.bat
  • C:\Users\Virtual\AppData\Local\Temp\BUMEUMUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\BywkYUMg.bat
  • C:\Users\Virtual\AppData\Local\Temp\CMooAEsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\CmkYoYMI.bat
  • C:\Users\Virtual\AppData\Local\Temp\DmEUUcoM.bat
  • C:\Users\Virtual\AppData\Local\Temp\DmocgkIA.bat
  • C:\Users\Virtual\AppData\Local\Temp\FokYoMQA.bat
  • C:\Users\Virtual\AppData\Local\Temp\GGEMMsEc.bat
  • C:\Users\Virtual\AppData\Local\Temp\GOossEAg.bat
  • C:\Users\Virtual\AppData\Local\Temp\GSkswQgY.bat
  • C:\Users\Virtual\AppData\Local\Temp\GqMgEIkI.bat
  • C:\Users\Virtual\AppData\Local\Temp\GygQIsQQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\HaQssYoU.bat
  • C:\Users\Virtual\AppData\Local\Temp\HqAcYkcw.bat
  • C:\Users\Virtual\AppData\Local\Temp\HywEUMYo.bat
  • C:\Users\Virtual\AppData\Local\Temp\IqIoQAgY.bat
  • C:\Users\Virtual\AppData\Local\Temp\IyAsMMIQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\JGQkwEYE.bat
  • C:\Users\Virtual\AppData\Local\Temp\JaUEUkIQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\KuIIQAAo.bat
  • C:\Users\Virtual\AppData\Local\Temp\LEQAccYE.bat
  • C:\Users\Virtual\AppData\Local\Temp\LIcoUIMs.bat
  • C:\Users\Virtual\AppData\Local\Temp\MKgAgcMQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\MwowgYcQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\NCcggEQw.bat
  • C:\Users\Virtual\AppData\Local\Temp\OaEIYcAQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\POYMogwc.bat
  • C:\Users\Virtual\AppData\Local\Temp\RcYQkYYw.bat
  • C:\Users\Virtual\AppData\Local\Temp\RskcAIUQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\SEIwQgIA.bat
  • C:\Users\Virtual\AppData\Local\Temp\SgowsQMs.bat
  • C:\Users\Virtual\AppData\Local\Temp\SqgsQsEo.bat
  • C:\Users\Virtual\AppData\Local\Temp\SysgcUIU.bat
  • C:\Users\Virtual\AppData\Local\Temp\TEcwIgkQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\TIgUUEgE.bat
  • C:\Users\Virtual\AppData\Local\Temp\TKsMMwIY.bat
  • C:\Users\Virtual\AppData\Local\Temp\TSgAoEcU.bat
  • C:\Users\Virtual\AppData\Local\Temp\TyYIYQMo.bat
  • C:\Users\Virtual\AppData\Local\Temp\UWMoIsQI.bat
  • C:\Users\Virtual\AppData\Local\Temp\UeowgwUM.bat
  • C:\Users\Virtual\AppData\Local\Temp\UgwMEgYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\UsgwQAgs.bat
  • C:\Users\Virtual\AppData\Local\Temp\UswwkoUE.bat
  • C:\Users\Virtual\AppData\Local\Temp\WEUEEosE.bat
  • C:\Users\Virtual\AppData\Local\Temp\XSwkwEsY.bat
  • C:\Users\Virtual\AppData\Local\Temp\Yggskowk.bat
  • C:\Users\Virtual\AppData\Local\Temp\YqAkkUoQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\Yssgkgwg.bat
  • C:\Users\Virtual\AppData\Local\Temp\ZkUEMgks.bat
  • C:\Users\Virtual\AppData\Local\Temp\ZusAMoco.bat
  • C:\Users\Virtual\AppData\Local\Temp\aGYsgUAY.bat
  • C:\Users\Virtual\AppData\Local\Temp\aKsQwIgU.bat
  • C:\Users\Virtual\AppData\Local\Temp\bUAgwoYc.bat
  • C:\Users\Virtual\AppData\Local\Temp\bqAMMwYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\bqMYIwEM.bat
  • C:\Users\Virtual\AppData\Local\Temp\cEMYEgAg.bat
  • C:\Users\Virtual\AppData\Local\Temp\d79e4c4ceb3abc8a51a01eff14a51694d7c25f9306ee71a922a01fddb48a15fe
  • C:\Users\Virtual\AppData\Local\Temp\dAEokQoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\dGwIMogs.bat
  • C:\Users\Virtual\AppData\Local\Temp\eOgwIUUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\eQMMwcUk.bat
  • C:\Users\Virtual\AppData\Local\Temp\eyUMMUEA.bat
  • C:\Users\Virtual\AppData\Local\Temp\fGgwEAEg.bat
  • C:\Users\Virtual\AppData\Local\Temp\fagwEogU.bat
  • C:\Users\Virtual\AppData\Local\Temp\file.vbs
  • C:\Users\Virtual\AppData\Local\Temp\fsYgwMEY.bat
  • C:\Users\Virtual\AppData\Local\Temp\hCUMswgg.bat
  • C:\Users\Virtual\AppData\Local\Temp\hSAYgIco.bat
  • C:\Users\Virtual\AppData\Local\Temp\jEcwwcYM.bat
  • C:\Users\Virtual\AppData\Local\Temp\jGAIEwIw.bat
  • C:\Users\Virtual\AppData\Local\Temp\jOQgIQgk.bat
  • C:\Users\Virtual\AppData\Local\Temp\juMYMEUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\kCAIkUoM.bat
  • C:\Users\Virtual\AppData\Local\Temp\kOIAsAcI.bat
  • C:\Users\Virtual\AppData\Local\Temp\kiIYkIsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\koIEwAsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\koggEUEo.bat
  • C:\Users\Virtual\AppData\Local\Temp\kowwQIAA.bat
  • C:\Users\Virtual\AppData\Local\Temp\lWkUkEkc.bat
  • C:\Users\Virtual\AppData\Local\Temp\lYAMYoQI.bat
  • C:\Users\Virtual\AppData\Local\Temp\logkcMgU.bat
  • C:\Users\Virtual\AppData\Local\Temp\maQQAQkQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\mkgEcgsA.bat
  • C:\Users\Virtual\AppData\Local\Temp\mmUMQIEM.bat
  • C:\Users\Virtual\AppData\Local\Temp\oQoMYoUo.bat
  • C:\Users\Virtual\AppData\Local\Temp\qSMQQskw.bat
  • C:\Users\Virtual\AppData\Local\Temp\qswMgoQU.bat
  • C:\Users\Virtual\AppData\Local\Temp\tIsYcIYw.bat
  • C:\Users\Virtual\AppData\Local\Temp\tKcQcYsI.bat
  • C:\Users\Virtual\AppData\Local\Temp\tSkgYEUI.bat
  • C:\Users\Virtual\AppData\Local\Temp\tWIUMUwc.bat
  • C:\Users\Virtual\AppData\Local\Temp\uAgUcwoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\uMYAgock.bat
  • C:\Users\Virtual\AppData\Local\Temp\viwEEEEU.bat
  • C:\Users\Virtual\AppData\Local\Temp\vmgAMQUc.bat
  • C:\Users\Virtual\AppData\Local\Temp\vqkAggEA.bat
  • C:\Users\Virtual\AppData\Local\Temp\wQAMAscY.bat
  • C:\Users\Virtual\AppData\Local\Temp\xCwIYsAo.bat
  • C:\Users\Virtual\AppData\Local\Temp\yCkIEIIM.bat
  • C:\Users\Virtual\AppData\Local\Temp\yIMEgsEY.bat
  • C:\Users\Virtual\AppData\Local\Temp\yIUkUYkg.bat
  • C:\Users\Virtual\AppData\Local\Temp\ySgUsEUc.bat
  • C:\Users\Virtual\AppData\Local\Temp\yakQUEIE.bat
  • C:\Users\Virtual\AppData\Local\Temp\ykgAgQYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\yqwkkcoc.bat
  • C:\Users\Virtual\AppData\Local\Temp\zEoEswoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\zwkYkQkE.bat
  • C:\Users\Virtual\qOUwQcUU\DUckIoEY.exe
  • C:\Users\Virtual\qOUwQcUU\DUckIoEY.inf

File-Deleted

  • C:\Users\Virtual\AppData\Local\Temp\AeYoUoQg.bat
  • C:\Users\Virtual\AppData\Local\Temp\AqQAYUEI.bat
  • C:\Users\Virtual\AppData\Local\Temp\AyoUUUEg.bat
  • C:\Users\Virtual\AppData\Local\Temp\BSgIAwAw.bat
  • C:\Users\Virtual\AppData\Local\Temp\BUMEUMUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\BywkYUMg.bat
  • C:\Users\Virtual\AppData\Local\Temp\CMooAEsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\CmkYoYMI.bat
  • C:\Users\Virtual\AppData\Local\Temp\DmEUUcoM.bat
  • C:\Users\Virtual\AppData\Local\Temp\DmocgkIA.bat
  • C:\Users\Virtual\AppData\Local\Temp\FokYoMQA.bat
  • C:\Users\Virtual\AppData\Local\Temp\GGEMMsEc.bat
  • C:\Users\Virtual\AppData\Local\Temp\GOossEAg.bat
  • C:\Users\Virtual\AppData\Local\Temp\GSkswQgY.bat
  • C:\Users\Virtual\AppData\Local\Temp\GqMgEIkI.bat
  • C:\Users\Virtual\AppData\Local\Temp\GygQIsQQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\HaQssYoU.bat
  • C:\Users\Virtual\AppData\Local\Temp\HqAcYkcw.bat
  • C:\Users\Virtual\AppData\Local\Temp\HywEUMYo.bat
  • C:\Users\Virtual\AppData\Local\Temp\IqIoQAgY.bat
  • C:\Users\Virtual\AppData\Local\Temp\IyAsMMIQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\JGQkwEYE.bat
  • C:\Users\Virtual\AppData\Local\Temp\JaUEUkIQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\KuIIQAAo.bat
  • C:\Users\Virtual\AppData\Local\Temp\LEQAccYE.bat
  • C:\Users\Virtual\AppData\Local\Temp\LIcoUIMs.bat
  • C:\Users\Virtual\AppData\Local\Temp\MKgAgcMQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\MwowgYcQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\NCcggEQw.bat
  • C:\Users\Virtual\AppData\Local\Temp\OaEIYcAQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\POYMogwc.bat
  • C:\Users\Virtual\AppData\Local\Temp\RcYQkYYw.bat
  • C:\Users\Virtual\AppData\Local\Temp\RskcAIUQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\SEIwQgIA.bat
  • C:\Users\Virtual\AppData\Local\Temp\SgowsQMs.bat
  • C:\Users\Virtual\AppData\Local\Temp\SqgsQsEo.bat
  • C:\Users\Virtual\AppData\Local\Temp\SysgcUIU.bat
  • C:\Users\Virtual\AppData\Local\Temp\TEcwIgkQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\TKsMMwIY.bat
  • C:\Users\Virtual\AppData\Local\Temp\TSgAoEcU.bat
  • C:\Users\Virtual\AppData\Local\Temp\TyYIYQMo.bat
  • C:\Users\Virtual\AppData\Local\Temp\UWMoIsQI.bat
  • C:\Users\Virtual\AppData\Local\Temp\UeowgwUM.bat
  • C:\Users\Virtual\AppData\Local\Temp\UgwMEgYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\UsgwQAgs.bat
  • C:\Users\Virtual\AppData\Local\Temp\UswwkoUE.bat
  • C:\Users\Virtual\AppData\Local\Temp\WEUEEosE.bat
  • C:\Users\Virtual\AppData\Local\Temp\XSwkwEsY.bat
  • C:\Users\Virtual\AppData\Local\Temp\Yggskowk.bat
  • C:\Users\Virtual\AppData\Local\Temp\YqAkkUoQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\Yssgkgwg.bat
  • C:\Users\Virtual\AppData\Local\Temp\ZkUEMgks.bat
  • C:\Users\Virtual\AppData\Local\Temp\ZusAMoco.bat
  • C:\Users\Virtual\AppData\Local\Temp\aGYsgUAY.bat
  • C:\Users\Virtual\AppData\Local\Temp\aKsQwIgU.bat
  • C:\Users\Virtual\AppData\Local\Temp\bUAgwoYc.bat
  • C:\Users\Virtual\AppData\Local\Temp\bqAMMwYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\bqMYIwEM.bat
  • C:\Users\Virtual\AppData\Local\Temp\cEMYEgAg.bat
  • C:\Users\Virtual\AppData\Local\Temp\d79e4c4ceb3abc8a51a01eff14a51694d7c25f9306ee71a922a01fddb48a15fe.exe
  • C:\Users\Virtual\AppData\Local\Temp\dAEokQoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\dGwIMogs.bat
  • C:\Users\Virtual\AppData\Local\Temp\eOgwIUUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\eQMMwcUk.bat
  • C:\Users\Virtual\AppData\Local\Temp\eyUMMUEA.bat
  • C:\Users\Virtual\AppData\Local\Temp\fGgwEAEg.bat
  • C:\Users\Virtual\AppData\Local\Temp\fagwEogU.bat
  • C:\Users\Virtual\AppData\Local\Temp\fsYgwMEY.bat
  • C:\Users\Virtual\AppData\Local\Temp\hCUMswgg.bat
  • C:\Users\Virtual\AppData\Local\Temp\hSAYgIco.bat
  • C:\Users\Virtual\AppData\Local\Temp\jEcwwcYM.bat
  • C:\Users\Virtual\AppData\Local\Temp\jGAIEwIw.bat
  • C:\Users\Virtual\AppData\Local\Temp\jOQgIQgk.bat
  • C:\Users\Virtual\AppData\Local\Temp\juMYMEUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\kCAIkUoM.bat
  • C:\Users\Virtual\AppData\Local\Temp\kOIAsAcI.bat
  • C:\Users\Virtual\AppData\Local\Temp\kiIYkIsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\koIEwAsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\koggEUEo.bat
  • C:\Users\Virtual\AppData\Local\Temp\kowwQIAA.bat
  • C:\Users\Virtual\AppData\Local\Temp\lWkUkEkc.bat
  • C:\Users\Virtual\AppData\Local\Temp\lYAMYoQI.bat
  • C:\Users\Virtual\AppData\Local\Temp\logkcMgU.bat
  • C:\Users\Virtual\AppData\Local\Temp\maQQAQkQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\mkgEcgsA.bat
  • C:\Users\Virtual\AppData\Local\Temp\mmUMQIEM.bat
  • C:\Users\Virtual\AppData\Local\Temp\oQoMYoUo.bat
  • C:\Users\Virtual\AppData\Local\Temp\qSMQQskw.bat
  • C:\Users\Virtual\AppData\Local\Temp\qswMgoQU.bat
  • C:\Users\Virtual\AppData\Local\Temp\tIsYcIYw.bat
  • C:\Users\Virtual\AppData\Local\Temp\tKcQcYsI.bat
  • C:\Users\Virtual\AppData\Local\Temp\tSkgYEUI.bat
  • C:\Users\Virtual\AppData\Local\Temp\tWIUMUwc.bat
  • C:\Users\Virtual\AppData\Local\Temp\uAgUcwoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\uMYAgock.bat
  • C:\Users\Virtual\AppData\Local\Temp\viwEEEEU.bat
  • C:\Users\Virtual\AppData\Local\Temp\vmgAMQUc.bat
  • C:\Users\Virtual\AppData\Local\Temp\vqkAggEA.bat
  • C:\Users\Virtual\AppData\Local\Temp\wQAMAscY.bat
  • C:\Users\Virtual\AppData\Local\Temp\xCwIYsAo.bat
  • C:\Users\Virtual\AppData\Local\Temp\yCkIEIIM.bat
  • C:\Users\Virtual\AppData\Local\Temp\yIMEgsEY.bat
  • C:\Users\Virtual\AppData\Local\Temp\yIUkUYkg.bat
  • C:\Users\Virtual\AppData\Local\Temp\ySgUsEUc.bat
  • C:\Users\Virtual\AppData\Local\Temp\yakQUEIE.bat
  • C:\Users\Virtual\AppData\Local\Temp\ykgAgQYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\yqwkkcoc.bat
  • C:\Users\Virtual\AppData\Local\Temp\zEoEswoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\zwkYkQkE.bat

File-Opened

  • C:\
  • C:\ProgramData\FeUgYgUs\geoswEAk
  • C:\ProgramData\FeUgYgUs\geoswEAk.inf
  • C:\Users\Virtual\AppData\Local\Temp\AeYoUoQg.bat
  • C:\Users\Virtual\AppData\Local\Temp\BUMEUMUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\CMooAEsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\DmocgkIA.bat
  • C:\Users\Virtual\AppData\Local\Temp\GGEMMsEc.bat
  • C:\Users\Virtual\AppData\Local\Temp\GygQIsQQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\HywEUMYo.bat
  • C:\Users\Virtual\AppData\Local\Temp\JGQkwEYE.bat
  • C:\Users\Virtual\AppData\Local\Temp\JaUEUkIQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\LIcoUIMs.bat
  • C:\Users\Virtual\AppData\Local\Temp\MKgAgcMQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\NCcggEQw.bat
  • C:\Users\Virtual\AppData\Local\Temp\POYMogwc.bat
  • C:\Users\Virtual\AppData\Local\Temp\RskcAIUQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\TSgAoEcU.bat
  • C:\Users\Virtual\AppData\Local\Temp\TyYIYQMo.bat
  • C:\Users\Virtual\AppData\Local\Temp\UWMoIsQI.bat
  • C:\Users\Virtual\AppData\Local\Temp\UgwMEgYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\UswwkoUE.bat
  • C:\Users\Virtual\AppData\Local\Temp\WEUEEosE.bat
  • C:\Users\Virtual\AppData\Local\Temp\XSwkwEsY.bat
  • C:\Users\Virtual\AppData\Local\Temp\Yggskowk.bat
  • C:\Users\Virtual\AppData\Local\Temp\YqAkkUoQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\ZusAMoco.bat
  • C:\Users\Virtual\AppData\Local\Temp\bUAgwoYc.bat
  • C:\Users\Virtual\AppData\Local\Temp\bqAMMwYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\bqMYIwEM.bat
  • C:\Users\Virtual\AppData\Local\Temp\dAEokQoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\eOgwIUUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\eyUMMUEA.bat
  • C:\Users\Virtual\AppData\Local\Temp\fGgwEAEg.bat
  • C:\Users\Virtual\AppData\Local\Temp\fagwEogU.bat
  • C:\Users\Virtual\AppData\Local\Temp\file.vbs
  • C:\Users\Virtual\AppData\Local\Temp\hSAYgIco.bat
  • C:\Users\Virtual\AppData\Local\Temp\jEcwwcYM.bat
  • C:\Users\Virtual\AppData\Local\Temp\jGAIEwIw.bat
  • C:\Users\Virtual\AppData\Local\Temp\juMYMEUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\kCAIkUoM.bat
  • C:\Users\Virtual\AppData\Local\Temp\kiIYkIsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\koIEwAsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\koggEUEo.bat
  • C:\Users\Virtual\AppData\Local\Temp\kowwQIAA.bat
  • C:\Users\Virtual\AppData\Local\Temp\lWkUkEkc.bat
  • C:\Users\Virtual\AppData\Local\Temp\oQoMYoUo.bat
  • C:\Users\Virtual\AppData\Local\Temp\qswMgoQU.bat
  • C:\Users\Virtual\AppData\Local\Temp\uAgUcwoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\wQAMAscY.bat
  • C:\Users\Virtual\AppData\Local\Temp\xCwIYsAo.bat
  • C:\Users\Virtual\AppData\Local\Temp\yCkIEIIM.bat
  • C:\Users\Virtual\AppData\Local\Temp\yakQUEIE.bat
  • C:\Users\Virtual\AppData\Local\Temp\ykgAgQYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\yqwkkcoc.bat
  • C:\Users\Virtual\AppData\Local\Temp\zEoEswoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\zwkYkQkE.bat
  • C:\Users\Virtual\qOUwQcUU\DUckIoEY
  • C:\Users\Virtual\qOUwQcUU\DUckIoEY.inf
  • C:\Windows\Globalization\Sorting\sortdefault.nls
  • C:\Windows\SysWOW64\cscript.exe
  • C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui

Network-Connects IP

  • 172.217.23.174
  • 190.186.45.170
  • 200.119.204.12
  • 200.87.164.69

Network-Resolves URL

  • google.com

Directory-Created

  • C:\ProgramData\BaYccoIY
  • C:\ProgramData\FeUgYgUs
  • C:\Users\Virtual\qOUwQcUU

Directory-Enumerated

  • C:\Python27\Scripts\cscript
  • C:\Python27\Scripts\cscript.*
  • C:\Python27\cscript
  • C:\Python27\cscript.*
  • C:\Users
  • C:\Users\Virtual
  • C:\Users\Virtual\AppData
  • C:\Users\Virtual\AppData\Local
  • C:\Users\Virtual\AppData\Local\Temp
  • C:\Users\Virtual\AppData\Local\Temp\AeYoUoQg.bat
  • C:\Users\Virtual\AppData\Local\Temp\BUMEUMUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\CMooAEsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\DmocgkIA.bat
  • C:\Users\Virtual\AppData\Local\Temp\GGEMMsEc.bat
  • C:\Users\Virtual\AppData\Local\Temp\GygQIsQQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\HywEUMYo.bat
  • C:\Users\Virtual\AppData\Local\Temp\JGQkwEYE.bat
  • C:\Users\Virtual\AppData\Local\Temp\JaUEUkIQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\LIcoUIMs.bat
  • C:\Users\Virtual\AppData\Local\Temp\MKgAgcMQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\NCcggEQw.bat
  • C:\Users\Virtual\AppData\Local\Temp\POYMogwc.bat
  • C:\Users\Virtual\AppData\Local\Temp\RskcAIUQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\TSgAoEcU.bat
  • C:\Users\Virtual\AppData\Local\Temp\TyYIYQMo.bat
  • C:\Users\Virtual\AppData\Local\Temp\UWMoIsQI.bat
  • C:\Users\Virtual\AppData\Local\Temp\UgwMEgYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\UswwkoUE.bat
  • C:\Users\Virtual\AppData\Local\Temp\WEUEEosE.bat
  • C:\Users\Virtual\AppData\Local\Temp\XSwkwEsY.bat
  • C:\Users\Virtual\AppData\Local\Temp\Yggskowk.bat
  • C:\Users\Virtual\AppData\Local\Temp\YqAkkUoQ.bat
  • C:\Users\Virtual\AppData\Local\Temp\ZusAMoco.bat
  • C:\Users\Virtual\AppData\Local\Temp\bUAgwoYc.bat
  • C:\Users\Virtual\AppData\Local\Temp\bqAMMwYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\bqMYIwEM.bat
  • C:\Users\Virtual\AppData\Local\Temp\cscript
  • C:\Users\Virtual\AppData\Local\Temp\cscript.*
  • C:\Users\Virtual\AppData\Local\Temp\d79e4c4ceb3abc8a51a01eff14a51694d7c25f9306ee71a922a01fddb48a15fe.*
  • C:\Users\Virtual\AppData\Local\Temp\d79e4c4ceb3abc8a51a01eff14a51694d7c25f9306ee71a922a01fddb48a15fe.COM
  • C:\Users\Virtual\AppData\Local\Temp\d79e4c4ceb3abc8a51a01eff14a51694d7c25f9306ee71a922a01fddb48a15fe.EXE
  • C:\Users\Virtual\AppData\Local\Temp\d79e4c4ceb3abc8a51a01eff14a51694d7c25f9306ee71a922a01fddb48a15fe.exe
  • C:\Users\Virtual\AppData\Local\Temp\dAEokQoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\eOgwIUUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\eyUMMUEA.bat
  • C:\Users\Virtual\AppData\Local\Temp\fGgwEAEg.bat
  • C:\Users\Virtual\AppData\Local\Temp\fagwEogU.bat
  • C:\Users\Virtual\AppData\Local\Temp\file.js
  • C:\Users\Virtual\AppData\Local\Temp\file.vbs
  • C:\Users\Virtual\AppData\Local\Temp\hSAYgIco.bat
  • C:\Users\Virtual\AppData\Local\Temp\jEcwwcYM.bat
  • C:\Users\Virtual\AppData\Local\Temp\jGAIEwIw.bat
  • C:\Users\Virtual\AppData\Local\Temp\juMYMEUU.bat
  • C:\Users\Virtual\AppData\Local\Temp\kCAIkUoM.bat
  • C:\Users\Virtual\AppData\Local\Temp\kiIYkIsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\koIEwAsM.bat
  • C:\Users\Virtual\AppData\Local\Temp\koggEUEo.bat
  • C:\Users\Virtual\AppData\Local\Temp\kowwQIAA.bat
  • C:\Users\Virtual\AppData\Local\Temp\lWkUkEkc.bat
  • C:\Users\Virtual\AppData\Local\Temp\oQoMYoUo.bat
  • C:\Users\Virtual\AppData\Local\Temp\qswMgoQU.bat
  • C:\Users\Virtual\AppData\Local\Temp\uAgUcwoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\wQAMAscY.bat
  • C:\Users\Virtual\AppData\Local\Temp\xCwIYsAo.bat
  • C:\Users\Virtual\AppData\Local\Temp\yCkIEIIM.bat
  • C:\Users\Virtual\AppData\Local\Temp\yakQUEIE.bat
  • C:\Users\Virtual\AppData\Local\Temp\ykgAgQYI.bat
  • C:\Users\Virtual\AppData\Local\Temp\yqwkkcoc.bat
  • C:\Users\Virtual\AppData\Local\Temp\zEoEswoE.bat
  • C:\Users\Virtual\AppData\Local\Temp\zwkYkQkE.bat
  • C:\Windows\System32\cscript.*
  • C:\Windows\System32\cscript.COM
  • C:\Windows\System32\cscript.exe

Registry Key-Opened

  • HKEY_CLASSES_ROOT\.vbs
  • HKEY_CLASSES_ROOT\VBSFile\ScriptEngine
  • HKEY_CURRENT_USER
  • HKEY_CURRENT_USER\Software\Microsoft\Command Processor
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
  • HKEY_CURRENT_USER\VBScript
  • HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBScript\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{000C10F1-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{06C9E010-38CE-11D4-A2A3-00104BD35090}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1A610570-38CE-11D4-A2A3-00104BD35090}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllGetSignedDataMsg
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllIsMyFileType2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllPutSignedDataMsg
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPublisher\Safer
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
  • HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Registry Key-Read

  • HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
  • HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
  • HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
  • HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
  • HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
  • HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
  • HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\Enabled
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\LogSecuritySuccesses
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\TrustPolicy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\UseWINSAFER
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vbs\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\ScriptEngine\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBScript\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\DefaultLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\Levels
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\LogFileName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\PolicyScope
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\SaferFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\IgnoreUserSettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\LogSecuritySuccesses
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\TrustPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\UseWINSAFER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Srp\GP\RuleCount
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\TSAppCompat
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\TSUserEnabled
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask

Registry Key-Written

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\DUckIoEY.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\geoswEAk.exe

Mutex-Accessed

  • *@
  • *@
  • *@
  • JIsYQIME
  • gEQAMQss
  • õ)@
  • ý)@

Processes

Name: reg.exePID: 2864Name: cscript.exePID: 2132Name: cmd.exePID: 3016Name: reg.exePID: 2952Name: reg.exePID: 2824Name: cscript.exePID: 2928Name: cmd.exePID: 2616Name: reg.exePID: 1880Name: reg.exePID: 2432Name: reg.exePID: 1036Name: cscript.exePID: 2540Name: cmd.exePID: 1412Name: reg.exePID: 1908Name: reg.exePID: 2084Name: reg.exePID: 3044Name: cscript.exePID: 2124Name: cmd.exePID: 2984Name: reg.exePID: 2068Name: reg.exePID: 2344Name: reg.exePID: 2284Name: cscript.exePID: 2900Name: cmd.exePID: 2380Name: reg.exePID: 2356Name: reg.exePID: 2156Name: reg.exePID: 1832Name: cscript.exePID: 1248Name: cmd.exePID: 3036Name: reg.exePID: 2896Name: reg.exePID: 2816Name: reg.exePID: 2556Name: cscript.exePID: 1900Name: cmd.exePID: 2436Name: reg.exePID: 2944Name: reg.exePID: 1884Name: reg.exePID: 2320Name: cscript.exePID: 1788Name: cmd.exePID: 2920Name: reg.exePID: 1068Name: reg.exePID: 1608Name: reg.exePID: 2532Name: cscript.exePID: 664Name: cmd.exePID: 2972Name: reg.exePID: 1736Name: reg.exePID: 1792Name: reg.exePID: 848Name: cscript.exePID: 2136Name: cmd.exePID: 876Name: reg.exePID: 1360Name: reg.exePID: 2840Name: reg.exePID: 2568Name: cscript.exePID: 2772Name: cmd.exePID: 2204Name: reg.exePID: 2172Name: reg.exePID: 1252Name: reg.exePID: 1948Name: cscript.exePID: 2324Name: cmd.exePID: 2164Name: reg.exePID: 2064Name: reg.exePID: 2988Name: reg.exePID: 3040Name: cscript.exePID: 2804Name: cmd.exePID: 2472Name: reg.exePID: 1648Name: reg.exePID: 680Name: reg.exePID: 1940Name: cscript.exePID: 3516Name: cmd.exePID: 3144Name: reg.exePID: 852Name: reg.exePID: 912Name: reg.exePID: 760Name: cscript.exePID: 3780Name: cmd.exePID: 3700Name: reg.exePID: 3548Name: reg.exePID: 3372Name: reg.exePID: 3248Name: cscript.exePID: 2652Name: cmd.exePID: 2092Name: reg.exePID: 4092Name: reg.exePID: 4008Name: reg.exePID: 3948Name: cscript.exePID: 3148Name: cmd.exePID: 1684Name: reg.exePID: 3488Name: reg.exePID: 3312Name: reg.exePID: 3260Name: cscript.exePID: 4024Name: cmd.exePID: 3332Name: reg.exePID: 604Name: reg.exePID: 3664Name: reg.exePID: 3580Name: cscript.exePID: 796Name: cmd.exePID: 3280Name: reg.exePID: 3168Name: reg.exePID: 3084Name: reg.exePID: 3980Name: cscript.exePID: 3928Name: cmd.exePID: 3736Name: reg.exePID: 3940Name: reg.exePID: 1680Name: reg.exePID: 3408Name: cscript.exePID: 3472Name: cmd.exePID: 3164Name: reg.exePID: 3112Name: reg.exePID: 4028Name: reg.exePID: 3880Name: cscript.exePID: 3956Name: cmd.exePID: 3612Name: reg.exePID: 1688Name: reg.exePID: 544Name: reg.exePID: 3180Name: cscript.exePID: 748Name: cmd.exePID: 3796Name: reg.exePID: 3268Name: reg.exePID: 3932Name: reg.exePID: 4060Name: cscript.exePID: 3908Name: cmd.exePID: 3920Name: reg.exePID: 1992Name: reg.exePID: 2148Name: reg.exePID: 3536Name: cscript.exePID: 2456Name: cmd.exePID: 3528Name: reg.exePID: 1816Name: reg.exePID: 1808Name: reg.exePID: 3512Name: cscript.exePID: 4032Name: cmd.exePID: 3080Name: reg.exePID: 3704Name: reg.exePID: 3976Name: reg.exePID: 3728Name: cscript.exePID: 1716Name: cmd.exePID: 1672Name: reg.exePID: 3996Name: reg.exePID: 2492Name: reg.exePID: 3764Name: cscript.exePID: 3752Name: cmd.exePID: 3500Name: reg.exePID: 3456Name: reg.exePID: 3836Name: reg.exePID: 4012Name: reg.exePID: 2112Name: cscript.exePID: 4084Name: cmd.exePID: 2392Name: reg.exePID: 3784Name: reg.exePID: 600Name: cscript.exePID: 504Name: cmd.exePID: 1352Name: reg.exePID: 1112Name: reg.exePID: 3532Name: reg.exePID: 3160Name: cscript.exePID: 2396Name: cmd.exePID: 3648Name: reg.exePID: 2276Name: reg.exePID: 3264Name: reg.exePID: 3316Name: reg.exePID: 2220Name: cscript.exePID: 3668Name: cmd.exePID: 2224Name: reg.exePID: 3876Name: reg.exePID: 2228Name: cscript.exePID: 4192Name: cmd.exePID: 3096Name: reg.exePID: 1484Name: reg.exePID: 3192Name: reg.exePID: 3464Name: reg.exePID: 4348Name: cscript.exePID: 4592Name: cmd.exePID: 4496Name: reg.exePID: 4440Name: reg.exePID: 4308Name: cscript.exePID: 5000Name: cmd.exePID: 4904Name: reg.exePID: 4848Name: reg.exePID: 4788Name: reg.exePID: 4700Name: cscript.exePID: 4444Name: cmd.exePID: 4100Name: reg.exePID: 2188Name: reg.exePID: 4104Name: reg.exePID: 5092Name: cscript.exePID: 4952Name: cmd.exePID: 4732Name: reg.exePID: 4708Name: reg.exePID: 4560Name: reg.exePID: 4472Name: cscript.exePID: 4356Name: cmd.exePID: 4216Name: reg.exePID: 3900Name: reg.exePID: 5064Name: reg.exePID: 4924Name: cscript.exePID: 5032Name: cmd.exePID: 4916Name: reg.exePID: 4500Name: reg.exePID: 4648Name: reg.exePID: 4604Name: cscript.exePID: 4260Name: cmd.exePID: 4528Name: reg.exePID: 4208Name: reg.exePID: 3324Name: reg.exePID: 5080Name: cscript.exePID: 4168Name: cmd.exePID: 5108Name: reg.exePID: 4652Name: reg.exePID: 4748Name: reg.exePID: 4660Name: cscript.exePID: 4896Name: cmd.exePID: 4672Name: reg.exePID: 4772Name: reg.exePID: 4396Name: reg.exePID: 4780Name: cscript.exePID: 4956Name: cmd.exePID: 3672Name: reg.exePID: 4988Name: reg.exePID: 756Name: reg.exePID: 4556Name: cscript.exePID: 4128Name: cmd.exePID: 2668Name: reg.exePID: 5036Name: reg.exePID: 4328Name: reg.exePID: 5052Name: cscript.exePID: 4968Name: cmd.exePID: 3404Name: reg.exePID: 4644Name: reg.exePID: 4148Name: reg.exePID: 4408Name: cscript.exePID: 4928Name: cmd.exePID: 4452Name: reg.exePID: 4344Name: reg.exePID: 4768Name: reg.exePID: 4684Name: cscript.exePID: 5012Name: cmd.exePID: 4152Name: reg.exePID: 4544Name: reg.exePID: 5068Name: reg.exePID: 1528Name: cscript.exePID: 4936Name: cmd.exePID: 4716Name: reg.exePID: 1928Name: reg.exePID: 3660Name: reg.exePID: 1976Name: cscript.exePID: 4200Name: cmd.exePID: 4456Name: reg.exePID: 4108Name: reg.exePID: 2196Name: reg.exePID: 4480Name: cscript.exePID: 5324Name: cmd.exePID: 5228Name: reg.exePID: 4720Name: reg.exePID: 4264Name: reg.exePID: 4288Name: cscript.exePID: 5720Name: cmd.exePID: 5628Name: reg.exePID: 5572Name: reg.exePID: 5480Name: reg.exePID: 5440Name: cscript.exePID: 6124Name: cmd.exePID: 6040Name: reg.exePID: 5968Name: reg.exePID: 5880Name: reg.exePID: 5840Name: cscript.exePID: 5664Name: cmd.exePID: 5452Name: reg.exePID: 5308Name: reg.exePID: 4112Name: reg.exePID: 5192Name: reg.exePID: 5732Name: reg.exePID: 5596Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 5668Name: cmd.exePID: 5408Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 5136Name: cmd.exePID: 5128Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 5924Name: cmd.exePID: 5788Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 5508Name: cmd.exePID: 5388Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 5152Name: cmd.exePID: 4864Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4812Name: cmd.exePID: 4164Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4580Name: cmd.exePID: 5076Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4992Name: cmd.exePID: 4212Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 5116Name: cmd.exePID: 4856Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4404Name: cmd.exePID: 4664Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2464Name: cmd.exePID: 5016Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4136Name: cmd.exePID: 5096Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4820Name: cmd.exePID: 4252Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 5084Name: cmd.exePID: 4424Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4696Name: cmd.exePID: 4244Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4796Name: cmd.exePID: 4504Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 1820Name: cmd.exePID: 4892Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4352Name: cmd.exePID: 4392Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3756Name: cmd.exePID: 5020Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4752Name: cmd.exePID: 4640Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4380Name: cmd.exePID: 4240Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2260Name: cmd.exePID: 2256Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 1676Name: cmd.exePID: 3460Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3276Name: cmd.exePID: 3520Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3496Name: cmd.exePID: 3508Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3244Name: cmd.exePID: 860Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3128Name: cmd.exePID: 1536Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 1896Name: cmd.exePID: 3116Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2528Name: cmd.exePID: 1476Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 1892Name: cmd.exePID: 3684Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3716Name: cmd.exePID: 1348Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4020Name: cmd.exePID: 3428Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3228Name: cmd.exePID: 3120Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 4088Name: cmd.exePID: 3776Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2212Name: cmd.exePID: 2584Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3952Name: cmd.exePID: 3856Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3552Name: cmd.exePID: 2244Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 1740Name: cmd.exePID: 3100Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3988Name: cmd.exePID: 3896Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3476Name: cmd.exePID: 3176Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2868Name: cmd.exePID: 2848Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 3000Name: cmd.exePID: 2564Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2076Name: cmd.exePID: 1612Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 1232Name: cmd.exePID: 1368Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2012Name: cmd.exePID: 2968Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2620Name: cmd.exePID: 2468Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 1340Name: cmd.exePID: 1144Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2296Name: cmd.exePID: 2088Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2168Name: cmd.exePID: 2412Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 1856Name: cmd.exePID: 564Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2784Name: cmd.exePID: 2376Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2884Name: cmd.exePID: 2872Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2400Name: cmd.exePID: 2176Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2916Name: cmd.exePID: 2768Name: DUckIoEY.exePID: 4268Name: geoswEAk.exePID: 2636Name: d79e4c4ceb3abc8a51a 1eff14a51694...PID: 2560System
Process Name PID Parent PID