Technical Information
- [<HKCU>\Software\Microsoft\Command Processor] 'AutoRun' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\doskey.exe"'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\doskey.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'doskey' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\doskey.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'doskey' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\doskey.exe"'
- %HOMEPATH%\Start Menu\Programs\Startup\doskey.lnk
- '<SYSTEM32>\taskkill.exe' /t /f /im "<File name>.exe"
- <SYSTEM32>\cmd.exe
- %APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\doskey.exe
- '31.##4.235.85':6892
- '31.##4.235.84':6892
- '31.##4.235.87':6892
- '31.##4.235.86':6892
- '31.##4.235.81':6892
- '31.##4.235.80':6892
- '31.##4.235.83':6892
- '31.##4.235.82':6892
- '31.##4.235.93':6892
- '31.##4.235.92':6892
- '31.##4.235.95':6892
- '31.##4.235.94':6892
- '31.##4.235.89':6892
- '31.##4.235.88':6892
- '31.##4.235.91':6892
- '31.##4.235.90':6892
- '31.##4.235.69':6892
- '31.##4.235.68':6892
- '31.##4.235.71':6892
- '31.##4.235.70':6892
- '31.##4.235.65':6892
- '31.##4.235.64':6892
- '31.##4.235.67':6892
- '31.##4.235.66':6892
- '31.##4.235.77':6892
- '31.##4.235.76':6892
- '31.##4.235.79':6892
- '31.##4.235.78':6892
- '31.##4.235.73':6892
- '31.##4.235.72':6892
- '31.##4.235.75':6892
- '31.##4.235.74':6892
- '31.##4.235.117':6892
- '31.##4.235.116':6892
- '31.##4.235.119':6892
- '31.##4.235.118':6892
- '31.##4.235.113':6892
- '31.##4.235.112':6892
- '31.##4.235.115':6892
- '31.##4.235.114':6892
- '31.##4.235.125':6892
- '31.##4.235.124':6892
- '31.##4.235.127':6892
- '31.##4.235.126':6892
- '31.##4.235.121':6892
- '31.##4.235.120':6892
- '31.##4.235.123':6892
- '31.##4.235.122':6892
- '31.##4.235.101':6892
- '31.##4.235.100':6892
- '31.##4.235.103':6892
- '31.##4.235.102':6892
- '31.##4.235.97':6892
- '31.##4.235.96':6892
- '31.##4.235.99':6892
- '31.##4.235.98':6892
- '31.##4.235.109':6892
- '31.##4.235.108':6892
- '31.##4.235.111':6892
- '31.##4.235.110':6892
- '31.##4.235.105':6892
- '31.##4.235.104':6892
- '31.##4.235.107':6892
- '31.##4.235.106':6892
- '31.##4.235.21':6892
- '31.##4.235.20':6892
- '31.##4.235.23':6892
- '31.##4.235.22':6892
- '31.##4.235.17':6892
- '31.##4.235.16':6892
- '31.##4.235.19':6892
- '31.##4.235.18':6892
- '31.##4.235.29':6892
- '31.##4.235.28':6892
- '31.##4.235.31':6892
- '31.##4.235.30':6892
- '31.##4.235.25':6892
- '31.##4.235.24':6892
- '31.##4.235.27':6892
- '31.##4.235.26':6892
- '31.##4.235.5':6892
- '31.##4.235.4':6892
- '31.##4.235.7':6892
- '31.##4.235.6':6892
- '31.##4.235.1':6892
- '31.##4.235.0':6892
- '31.##4.235.3':6892
- '31.##4.235.2':6892
- '31.##4.235.13':6892
- '31.##4.235.12':6892
- '31.##4.235.15':6892
- '31.##4.235.14':6892
- '31.##4.235.9':6892
- '31.##4.235.8':6892
- '31.##4.235.11':6892
- '31.##4.235.10':6892
- '31.##4.235.53':6892
- '31.##4.235.52':6892
- '31.##4.235.55':6892
- '31.##4.235.54':6892
- '31.##4.235.49':6892
- '31.##4.235.48':6892
- '31.##4.235.51':6892
- '31.##4.235.50':6892
- '31.##4.235.61':6892
- '31.##4.235.60':6892
- '31.##4.235.63':6892
- '31.##4.235.62':6892
- '31.##4.235.57':6892
- '31.##4.235.56':6892
- '31.##4.235.59':6892
- '31.##4.235.58':6892
- '31.##4.235.37':6892
- '31.##4.235.36':6892
- '31.##4.235.39':6892
- '31.##4.235.38':6892
- '31.##4.235.33':6892
- '31.##4.235.32':6892
- '31.##4.235.35':6892
- '31.##4.235.34':6892
- '31.##4.235.45':6892
- '31.##4.235.44':6892
- '31.##4.235.47':6892
- '31.##4.235.46':6892
- '31.##4.235.41':6892
- '31.##4.235.40':6892
- '31.##4.235.43':6892
- '31.##4.235.42':6892
- '31.##4.235.213':6892
- '31.##4.235.212':6892
- '31.##4.235.215':6892
- '31.##4.235.214':6892
- '31.##4.235.209':6892
- '31.##4.235.208':6892
- '31.##4.235.211':6892
- '31.##4.235.210':6892
- '31.##4.235.221':6892
- '31.##4.235.220':6892
- '31.##4.235.223':6892
- '31.##4.235.222':6892
- '31.##4.235.217':6892
- '31.##4.235.216':6892
- '31.##4.235.219':6892
- '31.##4.235.218':6892
- '31.##4.235.197':6892
- '31.##4.235.196':6892
- '31.##4.235.199':6892
- '31.##4.235.198':6892
- '31.##4.235.193':6892
- '31.##4.235.192':6892
- '31.##4.235.195':6892
- '31.##4.235.194':6892
- '31.##4.235.205':6892
- '31.##4.235.204':6892
- '31.##4.235.207':6892
- '31.##4.235.206':6892
- '31.##4.235.201':6892
- '31.##4.235.200':6892
- '31.##4.235.203':6892
- '31.##4.235.202':6892
- '31.##4.235.245':6892
- '31.##4.235.244':6892
- '31.##4.235.247':6892
- '31.##4.235.246':6892
- '31.##4.235.241':6892
- '31.##4.235.240':6892
- '31.##4.235.243':6892
- '31.##4.235.242':6892
- '31.##4.235.253':6892
- '31.##4.235.252':6892
- '31.##4.235.255':6892
- '31.##4.235.254':6892
- '31.##4.235.249':6892
- '31.##4.235.248':6892
- '31.##4.235.251':6892
- '31.##4.235.250':6892
- '31.##4.235.229':6892
- '31.##4.235.228':6892
- '31.##4.235.231':6892
- '31.##4.235.230':6892
- '31.##4.235.225':6892
- '31.##4.235.224':6892
- '31.##4.235.227':6892
- '31.##4.235.226':6892
- '31.##4.235.237':6892
- '31.##4.235.236':6892
- '31.##4.235.239':6892
- '31.##4.235.238':6892
- '31.##4.235.233':6892
- '31.##4.235.232':6892
- '31.##4.235.235':6892
- '31.##4.235.234':6892
- '31.##4.235.149':6892
- '31.##4.235.148':6892
- '31.##4.235.151':6892
- '31.##4.235.150':6892
- '31.##4.235.145':6892
- '31.##4.235.144':6892
- '31.##4.235.147':6892
- '31.##4.235.146':6892
- '31.##4.235.157':6892
- '31.##4.235.156':6892
- '31.##4.235.159':6892
- '31.##4.235.158':6892
- '31.##4.235.153':6892
- '31.##4.235.152':6892
- '31.##4.235.155':6892
- '31.##4.235.154':6892
- '31.##4.235.133':6892
- '31.##4.235.132':6892
- '31.##4.235.135':6892
- '31.##4.235.134':6892
- '31.##4.235.129':6892
- '31.##4.235.128':6892
- '31.##4.235.131':6892
- '31.##4.235.130':6892
- '31.##4.235.141':6892
- '31.##4.235.140':6892
- '31.##4.235.143':6892
- '31.##4.235.142':6892
- '31.##4.235.137':6892
- '31.##4.235.136':6892
- '31.##4.235.139':6892
- '31.##4.235.138':6892
- '31.##4.235.181':6892
- '31.##4.235.180':6892
- '31.##4.235.183':6892
- '31.##4.235.182':6892
- '31.##4.235.177':6892
- '31.##4.235.176':6892
- '31.##4.235.179':6892
- '31.##4.235.178':6892
- '31.##4.235.189':6892
- '31.##4.235.188':6892
- '31.##4.235.191':6892
- '31.##4.235.190':6892
- '31.##4.235.185':6892
- '31.##4.235.184':6892
- '31.##4.235.187':6892
- '31.##4.235.186':6892
- '31.##4.235.165':6892
- '31.##4.235.164':6892
- '31.##4.235.167':6892
- '31.##4.235.166':6892
- '31.##4.235.161':6892
- '31.##4.235.160':6892
- '31.##4.235.163':6892
- '31.##4.235.162':6892
- '31.##4.235.173':6892
- '31.##4.235.172':6892
- '31.##4.235.175':6892
- '31.##4.235.174':6892
- '31.##4.235.169':6892
- '31.##4.235.168':6892
- '31.##4.235.171':6892
- '31.##4.235.170':6892
- '31.##4.234.85':6892
- '31.##4.234.84':6892
- '31.##4.234.87':6892
- '31.##4.234.86':6892
- '31.##4.234.81':6892
- '31.##4.234.80':6892
- '31.##4.234.83':6892
- '31.##4.234.82':6892
- '31.##4.234.93':6892
- '31.##4.234.92':6892
- '31.##4.234.95':6892
- '31.##4.234.94':6892
- '31.##4.234.89':6892
- '31.##4.234.88':6892
- '31.##4.234.91':6892
- '31.##4.234.90':6892
- '31.##4.234.69':6892
- '31.##4.234.68':6892
- '31.##4.234.71':6892
- '31.##4.234.70':6892
- '31.##4.234.65':6892
- '31.##4.234.64':6892
- '31.##4.234.67':6892
- '31.##4.234.66':6892
- '31.##4.234.77':6892
- '31.##4.234.76':6892
- '31.##4.234.79':6892
- '31.##4.234.78':6892
- '31.##4.234.73':6892
- '31.##4.234.72':6892
- '31.##4.234.75':6892
- '31.##4.234.74':6892
- '31.##4.234.117':6892
- '31.##4.234.116':6892
- '31.##4.234.119':6892
- '31.##4.234.118':6892
- '31.##4.234.113':6892
- '31.##4.234.112':6892
- '31.##4.234.115':6892
- '31.##4.234.114':6892
- '31.##4.234.125':6892
- '31.##4.234.124':6892
- '31.##4.234.127':6892
- '31.##4.234.126':6892
- '31.##4.234.121':6892
- '31.##4.234.120':6892
- '31.##4.234.123':6892
- '31.##4.234.122':6892
- '31.##4.234.101':6892
- '31.##4.234.100':6892
- '31.##4.234.103':6892
- '31.##4.234.102':6892
- '31.##4.234.97':6892
- '31.##4.234.96':6892
- '31.##4.234.99':6892
- '31.##4.234.98':6892
- '31.##4.234.109':6892
- '31.##4.234.108':6892
- '31.##4.234.111':6892
- '31.##4.234.110':6892
- '31.##4.234.105':6892
- '31.##4.234.104':6892
- '31.##4.234.107':6892
- '31.##4.234.106':6892
- '31.##4.234.21':6892
- '31.##4.234.20':6892
- '31.##4.234.23':6892
- '31.##4.234.22':6892
- '31.##4.234.17':6892
- '31.##4.234.16':6892
- '31.##4.234.19':6892
- '31.##4.234.18':6892
- '31.##4.234.29':6892
- '31.##4.234.28':6892
- '31.##4.234.31':6892
- '31.##4.234.30':6892
- '31.##4.234.25':6892
- '31.##4.234.24':6892
- '31.##4.234.27':6892
- '31.##4.234.26':6892
- '31.##4.234.5':6892
- '31.##4.234.4':6892
- '31.##4.234.7':6892
- '31.##4.234.6':6892
- '31.##4.234.1':6892
- '31.##4.234.0':6892
- '31.##4.234.3':6892
- '31.##4.234.2':6892
- '31.##4.234.13':6892
- '31.##4.234.12':6892
- '31.##4.234.15':6892
- '31.##4.234.14':6892
- '31.##4.234.9':6892
- '31.##4.234.8':6892
- '31.##4.234.11':6892
- '31.##4.234.10':6892
- '31.##4.234.53':6892
- '31.##4.234.52':6892
- '31.##4.234.55':6892
- '31.##4.234.54':6892
- '31.##4.234.49':6892
- '31.##4.234.48':6892
- '31.##4.234.51':6892
- '31.##4.234.50':6892
- '31.##4.234.61':6892
- '31.##4.234.60':6892
- '31.##4.234.63':6892
- '31.##4.234.62':6892
- '31.##4.234.57':6892
- '31.##4.234.56':6892
- '31.##4.234.59':6892
- '31.##4.234.58':6892
- '31.##4.234.37':6892
- '31.##4.234.36':6892
- '31.##4.234.39':6892
- '31.##4.234.38':6892
- '31.##4.234.33':6892
- '31.##4.234.32':6892
- '31.##4.234.35':6892
- '31.##4.234.34':6892
- '31.##4.234.45':6892
- '31.##4.234.44':6892
- '31.##4.234.47':6892
- '31.##4.234.46':6892
- '31.##4.234.41':6892
- '31.##4.234.40':6892
- '31.##4.234.43':6892
- '31.##4.234.42':6892
- '31.##4.234.213':6892
- '31.##4.234.212':6892
- '31.##4.234.215':6892
- '31.##4.234.214':6892
- '31.##4.234.209':6892
- '31.##4.234.208':6892
- '31.##4.234.211':6892
- '31.##4.234.210':6892
- '31.##4.234.221':6892
- '31.##4.234.220':6892
- '31.##4.234.223':6892
- '31.##4.234.222':6892
- '31.##4.234.217':6892
- '31.##4.234.216':6892
- '31.##4.234.219':6892
- '31.##4.234.218':6892
- '31.##4.234.197':6892
- '31.##4.234.196':6892
- '31.##4.234.199':6892
- '31.##4.234.198':6892
- '31.##4.234.193':6892
- '31.##4.234.192':6892
- '31.##4.234.195':6892
- '31.##4.234.194':6892
- '31.##4.234.205':6892
- '31.##4.234.204':6892
- '31.##4.234.207':6892
- '31.##4.234.206':6892
- '31.##4.234.201':6892
- '31.##4.234.200':6892
- '31.##4.234.203':6892
- '31.##4.234.202':6892
- '31.##4.234.245':6892
- '31.##4.234.244':6892
- '31.##4.234.247':6892
- '31.##4.234.246':6892
- '31.##4.234.241':6892
- '31.##4.234.240':6892
- '31.##4.234.243':6892
- '31.##4.234.242':6892
- '31.##4.234.253':6892
- '31.##4.234.252':6892
- '31.##4.234.255':6892
- '31.##4.234.254':6892
- '31.##4.234.249':6892
- '31.##4.234.248':6892
- '31.##4.234.251':6892
- '31.##4.234.250':6892
- '31.##4.234.229':6892
- '31.##4.234.228':6892
- '31.##4.234.231':6892
- '31.##4.234.230':6892
- '31.##4.234.225':6892
- '31.##4.234.224':6892
- '31.##4.234.227':6892
- '31.##4.234.226':6892
- '31.##4.234.237':6892
- '31.##4.234.236':6892
- '31.##4.234.239':6892
- '31.##4.234.238':6892
- '31.##4.234.233':6892
- '31.##4.234.232':6892
- '31.##4.234.235':6892
- '31.##4.234.234':6892
- '31.##4.234.149':6892
- '31.##4.234.148':6892
- '31.##4.234.151':6892
- '31.##4.234.150':6892
- '31.##4.234.145':6892
- '31.##4.234.144':6892
- '31.##4.234.147':6892
- '31.##4.234.146':6892
- '31.##4.234.157':6892
- '31.##4.234.156':6892
- '31.##4.234.159':6892
- '31.##4.234.158':6892
- '31.##4.234.153':6892
- '31.##4.234.152':6892
- '31.##4.234.155':6892
- '31.##4.234.154':6892
- '31.##4.234.133':6892
- '31.##4.234.132':6892
- '31.##4.234.135':6892
- '31.##4.234.134':6892
- '31.##4.234.129':6892
- '31.##4.234.128':6892
- '31.##4.234.131':6892
- '31.##4.234.130':6892
- '31.##4.234.141':6892
- '31.##4.234.140':6892
- '31.##4.234.143':6892
- '31.##4.234.142':6892
- '31.##4.234.137':6892
- '31.##4.234.136':6892
- '31.##4.234.139':6892
- '31.##4.234.138':6892
- '31.##4.234.181':6892
- '31.##4.234.180':6892
- '31.##4.234.183':6892
- '31.##4.234.182':6892
- '31.##4.234.177':6892
- '31.##4.234.176':6892
- '31.##4.234.179':6892
- '31.##4.234.178':6892
- '31.##4.234.189':6892
- '31.##4.234.188':6892
- '31.##4.234.191':6892
- '31.##4.234.190':6892
- '31.##4.234.185':6892
- '31.##4.234.184':6892
- '31.##4.234.187':6892
- '31.##4.234.186':6892
- '31.##4.234.165':6892
- '31.##4.234.164':6892
- '31.##4.234.167':6892
- '31.##4.234.166':6892
- '31.##4.234.161':6892
- '31.##4.234.160':6892
- '31.##4.234.163':6892
- '31.##4.234.162':6892
- '31.##4.234.173':6892
- '31.##4.234.172':6892
- '31.##4.234.175':6892
- '31.##4.234.174':6892
- '31.##4.234.169':6892
- '31.##4.234.168':6892
- '31.##4.234.171':6892
- '31.##4.234.170':6892
- ClassName: '' WindowName: ''
- '%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\doskey.exe'
- '<SYSTEM32>\cmd.exe' /c taskkill /t /f /im "<File name>.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "<Full path to file>" > NUL