Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
Заражает следующие исполняемые файлы:
- <STUBS_DIR>\test.exe
- C:\Far2\Far.exe
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\reg.exe
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\gOEYMkgs\qwsi.exe
- %HOMEPATH%\gOEYMkgs\AcAw.exe
- %HOMEPATH%\gOEYMkgs\IIks.exe
- %HOMEPATH%\gOEYMkgs\QAIm.exe
- %HOMEPATH%\gOEYMkgs\VMAe.exe
- %HOMEPATH%\gOEYMkgs\jgAC.exe
- %HOMEPATH%\gOEYMkgs\pggY.exe
- %HOMEPATH%\gOEYMkgs\kIQY.exe
- %HOMEPATH%\gOEYMkgs\PwcM.exe
- %HOMEPATH%\gOEYMkgs\nEsu.exe
- %HOMEPATH%\gOEYMkgs\kMYC.exe
- %HOMEPATH%\gOEYMkgs\ToAa.exe
- %HOMEPATH%\gOEYMkgs\wskm.exe
- %HOMEPATH%\gOEYMkgs\mQEG.exe
- %HOMEPATH%\gOEYMkgs\GwYI.exe
- %HOMEPATH%\gOEYMkgs\xQEw.exe
- %HOMEPATH%\gOEYMkgs\SYYc.exe
- %HOMEPATH%\gOEYMkgs\PcIE.exe
- %HOMEPATH%\gOEYMkgs\WMcS.exe
- %HOMEPATH%\gOEYMkgs\IMAA.exe
- %HOMEPATH%\gOEYMkgs\UoQC.exe
- %HOMEPATH%\gOEYMkgs\rIYQ.exe
- %HOMEPATH%\gOEYMkgs\zMkm.exe
- %HOMEPATH%\gOEYMkgs\BIgi.exe
- %HOMEPATH%\gOEYMkgs\wUgu.exe
- %HOMEPATH%\gOEYMkgs\koAo.exe
- %HOMEPATH%\gOEYMkgs\Ssku.exe
- %HOMEPATH%\gOEYMkgs\ooUC.exe
- %HOMEPATH%\gOEYMkgs\dMQA.exe
- %HOMEPATH%\gOEYMkgs\oEoS.exe
- %HOMEPATH%\gOEYMkgs\FMIM.exe
- %HOMEPATH%\gOEYMkgs\ZcYm.exe
- %HOMEPATH%\gOEYMkgs\lUUw.exe
- %HOMEPATH%\gOEYMkgs\rYcW.exe
- %HOMEPATH%\gOEYMkgs\awwu.exe
- %HOMEPATH%\gOEYMkgs\noES.exe
- %HOMEPATH%\gOEYMkgs\fckK.exe
- %HOMEPATH%\gOEYMkgs\qQQq.exe
- %HOMEPATH%\gOEYMkgs\LMkK.exe
- %HOMEPATH%\gOEYMkgs\yAgs.exe
- %HOMEPATH%\gOEYMkgs\osoK.exe
- %HOMEPATH%\gOEYMkgs\soQU.exe
- %HOMEPATH%\gOEYMkgs\ToQc.exe
- %HOMEPATH%\gOEYMkgs\JMMU.exe
- %HOMEPATH%\gOEYMkgs\QgEC.exe
- %HOMEPATH%\gOEYMkgs\EEoe.exe
- %HOMEPATH%\gOEYMkgs\YAkG.exe
- %HOMEPATH%\gOEYMkgs\TcQa.exe
- %HOMEPATH%\gOEYMkgs\dQwM.exe
- %HOMEPATH%\gOEYMkgs\lkUA.exe
- %HOMEPATH%\gOEYMkgs\aEgS.exe
- %HOMEPATH%\gOEYMkgs\OQIA.exe
- %HOMEPATH%\gOEYMkgs\lMIU.exe
- %HOMEPATH%\gOEYMkgs\kock.exe
- %HOMEPATH%\gOEYMkgs\ocsu.exe
- C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
- %HOMEPATH%\gOEYMkgs\zIwm.exe
- %HOMEPATH%\gOEYMkgs\HEIe.exe
- %HOMEPATH%\gOEYMkgs\jUcw.exe
- %HOMEPATH%\gOEYMkgs\Kgwo.exe
- %HOMEPATH%\gOEYMkgs\kMoc.exe
- %HOMEPATH%\gOEYMkgs\mQoa.exe
- %HOMEPATH%\gOEYMkgs\HMkc.exe
- %HOMEPATH%\gOEYMkgs\bQwa.exe
- %HOMEPATH%\gOEYMkgs\pwsK.exe
- %HOMEPATH%\gOEYMkgs\QMEY.exe
- %HOMEPATH%\gOEYMkgs\AkUG.exe
- %HOMEPATH%\gOEYMkgs\ssEo.exe
- %HOMEPATH%\gOEYMkgs\EwoA.exe
- %HOMEPATH%\gOEYMkgs\RIMQ.exe
- %HOMEPATH%\gOEYMkgs\tscw.exe
- %HOMEPATH%\gOEYMkgs\aMEO.exe
- %HOMEPATH%\gOEYMkgs\yQou.exe
- %HOMEPATH%\gOEYMkgs\csEU.exe
- %HOMEPATH%\gOEYMkgs\TEEm.exe
- %HOMEPATH%\gOEYMkgs\mwwq.exe
- %HOMEPATH%\gOEYMkgs\tQAw.exe
- %HOMEPATH%\gOEYMkgs\WMMu.exe
- %HOMEPATH%\gOEYMkgs\cwIu.exe
- %HOMEPATH%\gOEYMkgs\iQom.exe
- %HOMEPATH%\gOEYMkgs\Ukgs.exe
- %HOMEPATH%\gOEYMkgs\WEMs.exe
- %HOMEPATH%\gOEYMkgs\ookW.exe
- %HOMEPATH%\gOEYMkgs\PwIa.exe
- %HOMEPATH%\gOEYMkgs\PIAg.exe
- %HOMEPATH%\gOEYMkgs\yAkW.exe
- %HOMEPATH%\gOEYMkgs\Uowm.exe
- %HOMEPATH%\gOEYMkgs\WAoa.exe
- %HOMEPATH%\gOEYMkgs\hsUk.exe
- %HOMEPATH%\gOEYMkgs\jIAQ.exe
- %HOMEPATH%\gOEYMkgs\xsUC.exe
- %HOMEPATH%\gOEYMkgs\aQsa.exe
- %HOMEPATH%\gOEYMkgs\pooI.exe
- %HOMEPATH%\gOEYMkgs\WMYa.exe
- %HOMEPATH%\gOEYMkgs\cYMq.exe
- %HOMEPATH%\gOEYMkgs\KMkY.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %HOMEPATH%\gOEYMkgs\yoUC.exe
- %HOMEPATH%\gOEYMkgs\wkUc.exe
- %HOMEPATH%\gOEYMkgs\SEIG.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %HOMEPATH%\gOEYMkgs\rwkC.exe
- %HOMEPATH%\gOEYMkgs\UMEe.exe
- %HOMEPATH%\gOEYMkgs\JgQU.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\yAwE.exe
- %HOMEPATH%\gOEYMkgs\TEwy.exe
- %HOMEPATH%\gOEYMkgs\nUgK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %HOMEPATH%\gOEYMkgs\VsIa.exe
- %HOMEPATH%\gOEYMkgs\HMUA.exe
- %TEMP%\WER4a85.dir00\appcompat.txt
- %TEMP%\WER4a85.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER4a85.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\koEK.exe
- %ALLUSERSPROFILE%\caQc.txt
- %TEMP%\WER4a85.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %HOMEPATH%\gOEYMkgs\pIMC.exe
- <Текущая директория>\<Имя файла>
- %HOMEPATH%\gOEYMkgs\TIUq.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %HOMEPATH%\gOEYMkgs\WQcc.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %HOMEPATH%\gOEYMkgs\FYww.exe
- %HOMEPATH%\gOEYMkgs\icUo.exe
- %HOMEPATH%\gOEYMkgs\DAMK.exe
- %HOMEPATH%\gOEYMkgs\NYIA.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %HOMEPATH%\gOEYMkgs\Wkwc.exe
- %HOMEPATH%\gOEYMkgs\icwY.exe
- %HOMEPATH%\gOEYMkgs\Zgwg.exe
- %HOMEPATH%\gOEYMkgs\mMEA.exe
- %HOMEPATH%\gOEYMkgs\lAQM.exe
- %HOMEPATH%\gOEYMkgs\BgoQ.exe
- %HOMEPATH%\gOEYMkgs\wEkk.exe
- %HOMEPATH%\gOEYMkgs\xcsc.exe
- %HOMEPATH%\gOEYMkgs\pUgS.exe
- %HOMEPATH%\gOEYMkgs\mQgA.exe
- %HOMEPATH%\gOEYMkgs\dUsC.exe
- %HOMEPATH%\gOEYMkgs\eUAg.exe
- %HOMEPATH%\gOEYMkgs\RIss.exe
- %HOMEPATH%\gOEYMkgs\GEAo.exe
- %HOMEPATH%\gOEYMkgs\pYcM.exe
- %HOMEPATH%\gOEYMkgs\YAIm.exe
- %HOMEPATH%\gOEYMkgs\VAIM.exe
- %HOMEPATH%\gOEYMkgs\wkoQ.exe
- %HOMEPATH%\gOEYMkgs\DgEU.exe
- %HOMEPATH%\gOEYMkgs\YsIa.exe
- %HOMEPATH%\gOEYMkgs\kkkk.exe
- %HOMEPATH%\gOEYMkgs\EAMI.exe
- %HOMEPATH%\gOEYMkgs\WgAO.exe
- %HOMEPATH%\gOEYMkgs\roIW.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\BEYW.exe
- %HOMEPATH%\gOEYMkgs\Gsck.exe
- %HOMEPATH%\gOEYMkgs\usYg.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\hAEG.exe
- %HOMEPATH%\gOEYMkgs\VQYI.exe
- %HOMEPATH%\gOEYMkgs\eMgs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %HOMEPATH%\gOEYMkgs\NQQK.exe
- %HOMEPATH%\gOEYMkgs\dwUE.exe
- %HOMEPATH%\gOEYMkgs\NsIs.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %HOMEPATH%\gOEYMkgs\aMQS.exe
- %HOMEPATH%\gOEYMkgs\QAUE.exe
- %HOMEPATH%\gOEYMkgs\rsEQ.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
Удаляет следующие файлы:
- %HOMEPATH%\gOEYMkgs\wskm.exe
- %HOMEPATH%\gOEYMkgs\mQEG.exe
- %HOMEPATH%\gOEYMkgs\SYYc.exe
- %HOMEPATH%\gOEYMkgs\GwYI.exe
- %HOMEPATH%\gOEYMkgs\PcIE.exe
- %HOMEPATH%\gOEYMkgs\UoQC.exe
- %HOMEPATH%\gOEYMkgs\WMcS.exe
- %HOMEPATH%\gOEYMkgs\rIYQ.exe
- %HOMEPATH%\gOEYMkgs\zMkm.exe
- %HOMEPATH%\gOEYMkgs\tQAw.exe
- %HOMEPATH%\gOEYMkgs\Ukgs.exe
- %HOMEPATH%\gOEYMkgs\aMEO.exe
- %HOMEPATH%\gOEYMkgs\yQou.exe
- %HOMEPATH%\gOEYMkgs\WEMs.exe
- %HOMEPATH%\gOEYMkgs\cwIu.exe
- %HOMEPATH%\gOEYMkgs\xQEw.exe
- %HOMEPATH%\gOEYMkgs\iQom.exe
- %HOMEPATH%\gOEYMkgs\WMMu.exe
- %HOMEPATH%\gOEYMkgs\IMAA.exe
- %HOMEPATH%\gOEYMkgs\kIQY.exe
- %HOMEPATH%\gOEYMkgs\BIgi.exe
- %HOMEPATH%\gOEYMkgs\PwcM.exe
- %HOMEPATH%\gOEYMkgs\pggY.exe
- %HOMEPATH%\gOEYMkgs\yAgs.exe
- %HOMEPATH%\gOEYMkgs\fckK.exe
- %HOMEPATH%\gOEYMkgs\qQQq.exe
- %HOMEPATH%\gOEYMkgs\osoK.exe
- %HOMEPATH%\gOEYMkgs\LMkK.exe
- %HOMEPATH%\gOEYMkgs\VMAe.exe
- %HOMEPATH%\gOEYMkgs\IIks.exe
- %HOMEPATH%\gOEYMkgs\ToAa.exe
- %HOMEPATH%\gOEYMkgs\QAIm.exe
- %HOMEPATH%\gOEYMkgs\qwsi.exe
- %HOMEPATH%\gOEYMkgs\nEsu.exe
- %HOMEPATH%\gOEYMkgs\kMYC.exe
- %HOMEPATH%\gOEYMkgs\AcAw.exe
- %HOMEPATH%\gOEYMkgs\jgAC.exe
- %HOMEPATH%\gOEYMkgs\csEU.exe
- %HOMEPATH%\gOEYMkgs\jUcw.exe
- %HOMEPATH%\gOEYMkgs\aEgS.exe
- %HOMEPATH%\gOEYMkgs\QMEY.exe
- %HOMEPATH%\gOEYMkgs\AkUG.exe
- %HOMEPATH%\gOEYMkgs\OQIA.exe
- %HOMEPATH%\gOEYMkgs\dQwM.exe
- %HOMEPATH%\gOEYMkgs\lMIU.exe
- %HOMEPATH%\gOEYMkgs\lkUA.exe
- %HOMEPATH%\gOEYMkgs\TcQa.exe
- %HOMEPATH%\gOEYMkgs\mQoa.exe
- %HOMEPATH%\gOEYMkgs\Kgwo.exe
- %HOMEPATH%\gOEYMkgs\HMkc.exe
- %HOMEPATH%\gOEYMkgs\bQwa.exe
- %HOMEPATH%\gOEYMkgs\kMoc.exe
- %HOMEPATH%\gOEYMkgs\RIMQ.exe
- %HOMEPATH%\gOEYMkgs\ssEo.exe
- %HOMEPATH%\gOEYMkgs\pwsK.exe
- %HOMEPATH%\gOEYMkgs\EwoA.exe
- %HOMEPATH%\gOEYMkgs\zIwm.exe
- %HOMEPATH%\gOEYMkgs\WMYa.exe
- %HOMEPATH%\gOEYMkgs\aQsa.exe
- %HOMEPATH%\gOEYMkgs\hsUk.exe
- %HOMEPATH%\gOEYMkgs\pooI.exe
- %HOMEPATH%\gOEYMkgs\jIAQ.exe
- %HOMEPATH%\gOEYMkgs\TEEm.exe
- %HOMEPATH%\gOEYMkgs\mwwq.exe
- %HOMEPATH%\gOEYMkgs\xsUC.exe
- %HOMEPATH%\gOEYMkgs\ookW.exe
- %HOMEPATH%\gOEYMkgs\ocsu.exe
- %HOMEPATH%\gOEYMkgs\tscw.exe
- %HOMEPATH%\gOEYMkgs\HEIe.exe
- %HOMEPATH%\gOEYMkgs\kock.exe
- %HOMEPATH%\gOEYMkgs\Uowm.exe
- %HOMEPATH%\gOEYMkgs\PwIa.exe
- %HOMEPATH%\gOEYMkgs\PIAg.exe
- %HOMEPATH%\gOEYMkgs\WAoa.exe
- %HOMEPATH%\gOEYMkgs\yAkW.exe
- %HOMEPATH%\gOEYMkgs\soQU.exe
- %HOMEPATH%\gOEYMkgs\Gsck.exe
- %HOMEPATH%\gOEYMkgs\BEYW.exe
- %HOMEPATH%\gOEYMkgs\aMQS.exe
- %HOMEPATH%\gOEYMkgs\usYg.exe
- %HOMEPATH%\gOEYMkgs\eMgs.exe
- %HOMEPATH%\gOEYMkgs\yAwE.exe
- %HOMEPATH%\gOEYMkgs\JgQU.exe
- %HOMEPATH%\gOEYMkgs\VQYI.exe
- %HOMEPATH%\gOEYMkgs\hAEG.exe
- %HOMEPATH%\gOEYMkgs\xcsc.exe
- %HOMEPATH%\gOEYMkgs\roIW.exe
- %HOMEPATH%\gOEYMkgs\pUgS.exe
- %HOMEPATH%\gOEYMkgs\wEkk.exe
- %HOMEPATH%\gOEYMkgs\NsIs.exe
- %HOMEPATH%\gOEYMkgs\rsEQ.exe
- %HOMEPATH%\gOEYMkgs\QAUE.exe
- %HOMEPATH%\gOEYMkgs\dwUE.exe
- %HOMEPATH%\gOEYMkgs\NQQK.exe
- %HOMEPATH%\gOEYMkgs\TEwy.exe
- %TEMP%\lakwoskk.bat
- %HOMEPATH%\gOEYMkgs\NYIA.exe
- %HOMEPATH%\gOEYMkgs\WQcc.exe
- %HOMEPATH%\gOEYMkgs\TIUq.exe
- %HOMEPATH%\gOEYMkgs\DAMK.exe
- %HOMEPATH%\gOEYMkgs\pIMC.exe
- %HOMEPATH%\gOEYMkgs\koEK.exe
- %HOMEPATH%\gOEYMkgs\FYww.exe
- %HOMEPATH%\gOEYMkgs\icUo.exe
- %HOMEPATH%\gOEYMkgs\UMEe.exe
- %HOMEPATH%\gOEYMkgs\yoUC.exe
- %HOMEPATH%\gOEYMkgs\VsIa.exe
- %HOMEPATH%\gOEYMkgs\nUgK.exe
- %HOMEPATH%\gOEYMkgs\KMkY.exe
- %HOMEPATH%\gOEYMkgs\SEIG.exe
- %HOMEPATH%\gOEYMkgs\HMUA.exe
- %HOMEPATH%\gOEYMkgs\wkUc.exe
- %HOMEPATH%\gOEYMkgs\rwkC.exe
- %HOMEPATH%\gOEYMkgs\dUsC.exe
- %HOMEPATH%\gOEYMkgs\oEoS.exe
- %HOMEPATH%\gOEYMkgs\rYcW.exe
- %HOMEPATH%\gOEYMkgs\wUgu.exe
- %HOMEPATH%\gOEYMkgs\koAo.exe
- %HOMEPATH%\gOEYMkgs\awwu.exe
- %HOMEPATH%\gOEYMkgs\ZcYm.exe
- %HOMEPATH%\gOEYMkgs\cYMq.exe
- %HOMEPATH%\gOEYMkgs\lUUw.exe
- %HOMEPATH%\gOEYMkgs\FMIM.exe
- %HOMEPATH%\gOEYMkgs\QgEC.exe
- %HOMEPATH%\gOEYMkgs\ToQc.exe
- %HOMEPATH%\gOEYMkgs\EEoe.exe
- %HOMEPATH%\gOEYMkgs\YAkG.exe
- %HOMEPATH%\gOEYMkgs\JMMU.exe
- %HOMEPATH%\gOEYMkgs\dMQA.exe
- %HOMEPATH%\gOEYMkgs\Ssku.exe
- %HOMEPATH%\gOEYMkgs\noES.exe
- %HOMEPATH%\gOEYMkgs\ooUC.exe
- %HOMEPATH%\gOEYMkgs\YAIm.exe
- %HOMEPATH%\gOEYMkgs\mMEA.exe
- %HOMEPATH%\gOEYMkgs\lAQM.exe
- %HOMEPATH%\gOEYMkgs\YsIa.exe
- %HOMEPATH%\gOEYMkgs\eUAg.exe
- %HOMEPATH%\gOEYMkgs\Zgwg.exe
- %HOMEPATH%\gOEYMkgs\BgoQ.exe
- %HOMEPATH%\gOEYMkgs\mQgA.exe
- %HOMEPATH%\gOEYMkgs\Wkwc.exe
- %HOMEPATH%\gOEYMkgs\icwY.exe
- %HOMEPATH%\gOEYMkgs\RIss.exe
- %HOMEPATH%\gOEYMkgs\GEAo.exe
- %HOMEPATH%\gOEYMkgs\VAIM.exe
- %HOMEPATH%\gOEYMkgs\pYcM.exe
- %HOMEPATH%\gOEYMkgs\wkoQ.exe
- %HOMEPATH%\gOEYMkgs\kkkk.exe
- %HOMEPATH%\gOEYMkgs\DgEU.exe
- %HOMEPATH%\gOEYMkgs\EAMI.exe
- %HOMEPATH%\gOEYMkgs\WgAO.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '74.##5.232.51':80
TCP:
Запросы HTTP GET:
- http://google.com/ via 74.##5.232.51
- http:/// via 74.##5.232.51
UDP:
- DNS ASK ap#.###coincharts.com
- DNS ASK google.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'Open'
- ClassName: '' WindowName: 'Run'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'BUTTON' WindowName: 'START'
- ClassName: '' WindowName: 'lacMcYws.exe'
- ClassName: 'WorkerW' WindowName: ''
- ClassName: 'DV2ControlHost' WindowName: ''
- ClassName: '' WindowName: 'xSMgIcIg'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
- ClassName: '' WindowName: 'Open File'
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: 'Windows Internet Explorer'
