Trojan.MulDrop7.35263

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Заражает следующие исполняемые файлы:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Запускает на исполнение:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cmd.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\WER8c68.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\GosW.exe
%TEMP%\WER8c68.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\lkMw.exe
%HOMEPATH%\gOEYMkgs\YAIe.exe
%HOMEPATH%\gOEYMkgs\IgkI.exe
%HOMEPATH%\gOEYMkgs\qMQC.exe
%HOMEPATH%\gOEYMkgs\AIoQ.exe
%HOMEPATH%\gOEYMkgs\pMMU.exe
%HOMEPATH%\gOEYMkgs\OYwa.exe
%HOMEPATH%\gOEYMkgs\vYwq.exe
%TEMP%\WER8c68.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\MAQY.exe
%HOMEPATH%\gOEYMkgs\AIUW.exe
%HOMEPATH%\gOEYMkgs\vIoQ.exe
%HOMEPATH%\gOEYMkgs\uIYK.exe
%HOMEPATH%\gOEYMkgs\koMq.exe
%HOMEPATH%\gOEYMkgs\FIsu.exe
%HOMEPATH%\gOEYMkgs\Tkwo.exe
%HOMEPATH%\gOEYMkgs\ugQs.exe
%HOMEPATH%\gOEYMkgs\TAIM.exe
%HOMEPATH%\gOEYMkgs\FMUk.exe
%HOMEPATH%\gOEYMkgs\ywgq.exe
%HOMEPATH%\gOEYMkgs\FkEk.exe
%HOMEPATH%\gOEYMkgs\PEcs.exe
%TEMP%\WER8c68.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\HoAG.exe
%HOMEPATH%\gOEYMkgs\vssw.exe
%HOMEPATH%\gOEYMkgs\xkcA.exe
%HOMEPATH%\gOEYMkgs\cIka.exe
%HOMEPATH%\gOEYMkgs\Qcsm.exe
%HOMEPATH%\gOEYMkgs\pscU.exe
%HOMEPATH%\gOEYMkgs\DwgW.exe
%HOMEPATH%\gOEYMkgs\SgwI.exe
%HOMEPATH%\gOEYMkgs\ycwa.exe
%HOMEPATH%\gOEYMkgs\nUMM.exe
%HOMEPATH%\gOEYMkgs\RkwI.exe
%HOMEPATH%\gOEYMkgs\GAcG.exe
%HOMEPATH%\gOEYMkgs\EUYw.exe
%HOMEPATH%\gOEYMkgs\qUUe.exe
%HOMEPATH%\gOEYMkgs\XoQG.exe
%HOMEPATH%\gOEYMkgs\YQAe.exe
%HOMEPATH%\gOEYMkgs\jQAa.exe
%HOMEPATH%\gOEYMkgs\lIoQ.exe
%HOMEPATH%\gOEYMkgs\NAoU.exe
%HOMEPATH%\gOEYMkgs\zEcQ.exe
%HOMEPATH%\gOEYMkgs\CMYy.exe
%HOMEPATH%\gOEYMkgs\YgwQ.exe
%HOMEPATH%\gOEYMkgs\ncsw.exe
%HOMEPATH%\gOEYMkgs\EEgi.exe
%HOMEPATH%\gOEYMkgs\bYYM.exe
%HOMEPATH%\gOEYMkgs\sMka.exe
%HOMEPATH%\gOEYMkgs\FkwG.exe
%HOMEPATH%\gOEYMkgs\bYQQ.exe
%HOMEPATH%\gOEYMkgs\qgYm.exe
%HOMEPATH%\gOEYMkgs\SIwk.exe
%HOMEPATH%\gOEYMkgs\NcQk.exe
%HOMEPATH%\gOEYMkgs\bwUM.exe
%HOMEPATH%\gOEYMkgs\vQAg.exe
%HOMEPATH%\gOEYMkgs\JAca.exe
%HOMEPATH%\gOEYMkgs\PssW.exe
%HOMEPATH%\gOEYMkgs\OgEG.exe
%HOMEPATH%\gOEYMkgs\zogO.exe
%HOMEPATH%\gOEYMkgs\loAE.exe
%HOMEPATH%\gOEYMkgs\TEoS.exe
%TEMP%\WER064a.dir00\appcompat.txt
%TEMP%\WER064a.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER064a.dir00\ZgMYMIIE.exe.mdmp
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
%TEMP%\WER064a.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\XUAo.exe
%HOMEPATH%\gOEYMkgs\fcIC.exe
%HOMEPATH%\gOEYMkgs\RgAW.exe
%HOMEPATH%\gOEYMkgs\gIYE.exe
%HOMEPATH%\gOEYMkgs\hQwu.exe
%HOMEPATH%\gOEYMkgs\PMYs.exe
%HOMEPATH%\gOEYMkgs\WQcy.exe
%HOMEPATH%\gOEYMkgs\YYoI.exe
%HOMEPATH%\gOEYMkgs\ZowY.exe
%HOMEPATH%\gOEYMkgs\KMcq.exe
%HOMEPATH%\gOEYMkgs\OkAi.exe
%HOMEPATH%\gOEYMkgs\tgwK.exe
%HOMEPATH%\gOEYMkgs\OEwc.exe
%HOMEPATH%\gOEYMkgs\BQci.exe
%HOMEPATH%\gOEYMkgs\GsgI.exe
%HOMEPATH%\gOEYMkgs\JIsK.exe
%HOMEPATH%\gOEYMkgs\xowY.exe
%HOMEPATH%\gOEYMkgs\DcIe.exe
%HOMEPATH%\gOEYMkgs\kIIc.exe
%HOMEPATH%\gOEYMkgs\uIYO.exe
%HOMEPATH%\gOEYMkgs\pEIA.exe
%HOMEPATH%\gOEYMkgs\vQcG.exe
%HOMEPATH%\gOEYMkgs\EYwc.exe
%HOMEPATH%\gOEYMkgs\YwQE.exe
%HOMEPATH%\gOEYMkgs\EAYO.exe
%HOMEPATH%\gOEYMkgs\dAEk.exe
%HOMEPATH%\gOEYMkgs\ZYUA.exe
%HOMEPATH%\gOEYMkgs\TUIq.exe
%HOMEPATH%\gOEYMkgs\XUII.exe
%HOMEPATH%\gOEYMkgs\NkAG.exe
%HOMEPATH%\gOEYMkgs\MwQe.exe
%HOMEPATH%\gOEYMkgs\JEgG.exe
%HOMEPATH%\gOEYMkgs\EUUs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\oUYg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\vUcG.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\NccA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\MgUK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\TYYY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\GEUM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\Kwka.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\LUUw.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%HOMEPATH%\gOEYMkgs\KkgU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\iIAc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\GIIG.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\AQwc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%TEMP%\WER990a.dir00\appcompat.txt
%TEMP%\WER990a.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER990a.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\hAko.exe
%TEMP%\WER990a.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\TgYq.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\LYMO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\fQMu.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%HOMEPATH%\gOEYMkgs\GIsI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\Iggu.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\sYUI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\SUsW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\zQoG.exe
%HOMEPATH%\gOEYMkgs\XoEi.exe
%HOMEPATH%\gOEYMkgs\MYAK.exe
%HOMEPATH%\gOEYMkgs\lksw.exe
%HOMEPATH%\gOEYMkgs\akUM.exe
%HOMEPATH%\gOEYMkgs\nIsy.exe
%HOMEPATH%\gOEYMkgs\HMse.exe
%HOMEPATH%\gOEYMkgs\wAQM.exe
%HOMEPATH%\gOEYMkgs\SQoi.exe
%HOMEPATH%\gOEYMkgs\ZQEE.exe
%HOMEPATH%\gOEYMkgs\hYAy.exe
%HOMEPATH%\gOEYMkgs\mgEG.exe
%HOMEPATH%\gOEYMkgs\iwgo.exe
%HOMEPATH%\gOEYMkgs\FAEY.exe
%HOMEPATH%\gOEYMkgs\YsMc.exe
%HOMEPATH%\gOEYMkgs\wYgc.exe
%HOMEPATH%\gOEYMkgs\gssw.exe
%HOMEPATH%\gOEYMkgs\nQAO.exe
%HOMEPATH%\gOEYMkgs\QIQi.exe
%HOMEPATH%\gOEYMkgs\dccy.exe
%HOMEPATH%\gOEYMkgs\mgUy.exe
%HOMEPATH%\gOEYMkgs\zwwK.exe
%HOMEPATH%\gOEYMkgs\xsQg.exe
%HOMEPATH%\gOEYMkgs\fcos.exe
%HOMEPATH%\gOEYMkgs\MQEu.exe
%HOMEPATH%\gOEYMkgs\uAQw.exe
%HOMEPATH%\gOEYMkgs\DUog.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%HOMEPATH%\gOEYMkgs\HcAI.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\UsYI.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\cYIc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\NokM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\OssS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\lEIE.exe
%TEMP%\WER10ac.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\EMoc.exe
%TEMP%\WER10ac.dir00\manifest.txt
%TEMP%\WER10ac.dir00\appcompat.txt
%TEMP%\WER10ac.dir00\ZgMYMIIE.exe.hdmp
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%HOMEPATH%\gOEYMkgs\bMIG.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\tEwS.exe
<Текущая директория>\<Имя файла>

Удаляет следующие файлы:

%HOMEPATH%\gOEYMkgs\JIsK.exe
%HOMEPATH%\gOEYMkgs\sMka.exe
%HOMEPATH%\gOEYMkgs\BQci.exe
%HOMEPATH%\gOEYMkgs\GsgI.exe
%HOMEPATH%\gOEYMkgs\koMq.exe
%HOMEPATH%\gOEYMkgs\AIUW.exe
%HOMEPATH%\gOEYMkgs\vIoQ.exe
%HOMEPATH%\gOEYMkgs\FIsu.exe
%HOMEPATH%\gOEYMkgs\Tkwo.exe
%HOMEPATH%\gOEYMkgs\kIIc.exe
%HOMEPATH%\gOEYMkgs\tgwK.exe
%HOMEPATH%\gOEYMkgs\OEwc.exe
%HOMEPATH%\gOEYMkgs\uIYO.exe
%HOMEPATH%\gOEYMkgs\OkAi.exe
%HOMEPATH%\gOEYMkgs\YYoI.exe
%HOMEPATH%\gOEYMkgs\xowY.exe
%HOMEPATH%\gOEYMkgs\DcIe.exe
%HOMEPATH%\gOEYMkgs\ZowY.exe
%HOMEPATH%\gOEYMkgs\KMcq.exe
%HOMEPATH%\gOEYMkgs\uIYK.exe
%HOMEPATH%\gOEYMkgs\vYwq.exe
%HOMEPATH%\gOEYMkgs\qMQC.exe
%HOMEPATH%\gOEYMkgs\GosW.exe
%HOMEPATH%\gOEYMkgs\OYwa.exe
%HOMEPATH%\gOEYMkgs\AIoQ.exe
%HOMEPATH%\gOEYMkgs\lIoQ.exe
%HOMEPATH%\gOEYMkgs\NAoU.exe
%HOMEPATH%\gOEYMkgs\pMMU.exe
%HOMEPATH%\gOEYMkgs\jQAa.exe
%HOMEPATH%\gOEYMkgs\IgkI.exe
%HOMEPATH%\gOEYMkgs\PEcs.exe
%HOMEPATH%\gOEYMkgs\ugQs.exe
%HOMEPATH%\gOEYMkgs\ywgq.exe
%HOMEPATH%\gOEYMkgs\FkEk.exe
%HOMEPATH%\gOEYMkgs\TAIM.exe
%HOMEPATH%\gOEYMkgs\lkMw.exe
%HOMEPATH%\gOEYMkgs\YAIe.exe
%HOMEPATH%\gOEYMkgs\FMUk.exe
%HOMEPATH%\gOEYMkgs\MAQY.exe
%HOMEPATH%\gOEYMkgs\XUII.exe
%HOMEPATH%\gOEYMkgs\fcIC.exe
%HOMEPATH%\gOEYMkgs\RgAW.exe
%HOMEPATH%\gOEYMkgs\PMYs.exe
%HOMEPATH%\gOEYMkgs\XUAo.exe
%HOMEPATH%\gOEYMkgs\TEoS.exe
%HOMEPATH%\gOEYMkgs\bwUM.exe
%HOMEPATH%\gOEYMkgs\FkwG.exe
%HOMEPATH%\gOEYMkgs\SIwk.exe
%HOMEPATH%\gOEYMkgs\NcQk.exe
%HOMEPATH%\gOEYMkgs\hQwu.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize
%HOMEPATH%\gOEYMkgs\gIYE.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log
%HOMEPATH%\gOEYMkgs\bYQQ.exe
%HOMEPATH%\gOEYMkgs\vQcG.exe
%HOMEPATH%\gOEYMkgs\EYwc.exe
%HOMEPATH%\gOEYMkgs\dAEk.exe
%HOMEPATH%\gOEYMkgs\pEIA.exe
%HOMEPATH%\gOEYMkgs\NkAG.exe
%HOMEPATH%\gOEYMkgs\ZYUA.exe
%HOMEPATH%\gOEYMkgs\TUIq.exe
%HOMEPATH%\gOEYMkgs\MwQe.exe
%HOMEPATH%\gOEYMkgs\JEgG.exe
%HOMEPATH%\gOEYMkgs\EAYO.exe
%HOMEPATH%\gOEYMkgs\zogO.exe
%HOMEPATH%\gOEYMkgs\loAE.exe
%HOMEPATH%\gOEYMkgs\qgYm.exe
%HOMEPATH%\gOEYMkgs\OgEG.exe
%HOMEPATH%\gOEYMkgs\vQAg.exe
%HOMEPATH%\gOEYMkgs\WQcy.exe
%HOMEPATH%\gOEYMkgs\YwQE.exe
%HOMEPATH%\gOEYMkgs\JAca.exe
%HOMEPATH%\gOEYMkgs\PssW.exe
%HOMEPATH%\gOEYMkgs\qUUe.exe
%HOMEPATH%\gOEYMkgs\UsYI.exe
%HOMEPATH%\gOEYMkgs\DUog.exe
%HOMEPATH%\gOEYMkgs\bMIG.exe
%HOMEPATH%\gOEYMkgs\lEIE.exe
%HOMEPATH%\gOEYMkgs\HcAI.exe
%HOMEPATH%\gOEYMkgs\NokM.exe
%HOMEPATH%\gOEYMkgs\LUUw.exe
%HOMEPATH%\gOEYMkgs\OssS.exe
%HOMEPATH%\gOEYMkgs\cYIc.exe
%TEMP%\ywcEAAEI.bat
%HOMEPATH%\gOEYMkgs\mgEG.exe
%HOMEPATH%\gOEYMkgs\HMse.exe
%HOMEPATH%\gOEYMkgs\ZQEE.exe
%HOMEPATH%\gOEYMkgs\hYAy.exe
%HOMEPATH%\gOEYMkgs\wAQM.exe
%HOMEPATH%\gOEYMkgs\EMoc.exe
%HOMEPATH%\gOEYMkgs\tEwS.exe
%HOMEPATH%\gOEYMkgs\SQoi.exe
%HOMEPATH%\gOEYMkgs\uAQw.exe
%HOMEPATH%\gOEYMkgs\KkgU.exe
%HOMEPATH%\gOEYMkgs\GIsI.exe
%HOMEPATH%\gOEYMkgs\LYMO.exe
%HOMEPATH%\gOEYMkgs\MgUK.exe
%HOMEPATH%\gOEYMkgs\fQMu.exe
%HOMEPATH%\gOEYMkgs\sYUI.exe
%HOMEPATH%\gOEYMkgs\TgYq.exe
%HOMEPATH%\gOEYMkgs\hAko.exe
%HOMEPATH%\gOEYMkgs\SUsW.exe
%HOMEPATH%\gOEYMkgs\Iggu.exe
%HOMEPATH%\gOEYMkgs\NccA.exe
%HOMEPATH%\gOEYMkgs\AQwc.exe
%HOMEPATH%\gOEYMkgs\iIAc.exe
%HOMEPATH%\gOEYMkgs\Kwka.exe
%HOMEPATH%\gOEYMkgs\GIIG.exe
%HOMEPATH%\gOEYMkgs\GEUM.exe
%HOMEPATH%\gOEYMkgs\oUYg.exe
%HOMEPATH%\gOEYMkgs\TYYY.exe
%HOMEPATH%\gOEYMkgs\vUcG.exe
%HOMEPATH%\gOEYMkgs\EUUs.exe
%HOMEPATH%\gOEYMkgs\MYAK.exe
%HOMEPATH%\gOEYMkgs\HoAG.exe
%HOMEPATH%\gOEYMkgs\vssw.exe
%HOMEPATH%\gOEYMkgs\Qcsm.exe
%HOMEPATH%\gOEYMkgs\pscU.exe
%HOMEPATH%\gOEYMkgs\xkcA.exe
%HOMEPATH%\gOEYMkgs\GAcG.exe
%HOMEPATH%\gOEYMkgs\DwgW.exe
%HOMEPATH%\gOEYMkgs\nUMM.exe
%HOMEPATH%\gOEYMkgs\RkwI.exe
%HOMEPATH%\gOEYMkgs\cIka.exe
%HOMEPATH%\gOEYMkgs\ncsw.exe
%HOMEPATH%\gOEYMkgs\EEgi.exe
%HOMEPATH%\gOEYMkgs\XoQG.exe
%HOMEPATH%\gOEYMkgs\YQAe.exe
%HOMEPATH%\gOEYMkgs\bYYM.exe
%HOMEPATH%\gOEYMkgs\YgwQ.exe
%HOMEPATH%\gOEYMkgs\EUYw.exe
%HOMEPATH%\gOEYMkgs\zEcQ.exe
%HOMEPATH%\gOEYMkgs\CMYy.exe
%HOMEPATH%\gOEYMkgs\SgwI.exe
%HOMEPATH%\gOEYMkgs\zwwK.exe
%HOMEPATH%\gOEYMkgs\iwgo.exe
%HOMEPATH%\gOEYMkgs\dccy.exe
%HOMEPATH%\gOEYMkgs\mgUy.exe
%HOMEPATH%\gOEYMkgs\lksw.exe
%HOMEPATH%\gOEYMkgs\zQoG.exe
%HOMEPATH%\gOEYMkgs\XoEi.exe
%HOMEPATH%\gOEYMkgs\akUM.exe
%HOMEPATH%\gOEYMkgs\nIsy.exe
%HOMEPATH%\gOEYMkgs\MQEu.exe
%HOMEPATH%\gOEYMkgs\nQAO.exe
%HOMEPATH%\gOEYMkgs\QIQi.exe
%HOMEPATH%\gOEYMkgs\ycwa.exe
%HOMEPATH%\gOEYMkgs\gssw.exe
%HOMEPATH%\gOEYMkgs\FAEY.exe
%HOMEPATH%\gOEYMkgs\xsQg.exe
%HOMEPATH%\gOEYMkgs\fcos.exe
%HOMEPATH%\gOEYMkgs\YsMc.exe
%HOMEPATH%\gOEYMkgs\wYgc.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'74.##5.232.51':443
'ap#.###coincharts.com':443
'74.##5.232.51':80

TCP:

Запросы HTTP GET:

http://google.com/ via 74.##5.232.51
http:/// via 74.##5.232.51

UDP:

DNS ASK ma##.google.com
DNS ASK ap#.###coincharts.com
DNS ASK google.com

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'Run'
ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Open'
ClassName: 'WorkerW' WindowName: ''
ClassName: 'DV2ControlHost' WindowName: ''
ClassName: 'BUTTON' WindowName: 'START'
ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'xSMgIcIg'
ClassName: '' WindowName: 'Windows Internet Explorer'
ClassName: '' WindowName: 'Open File'
ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней