Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
Заражает следующие исполняемые файлы:
- <STUBS_DIR>\test.exe
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
- расширений файлов
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '%TEMP%\ReaderUpdater.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '<SYSTEM32>\cmd.exe' /c %TEMP%\ReaderUpdater.exe
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\gOEYMkgs\vAos.exe
- %HOMEPATH%\gOEYMkgs\bYAy.exe
- %HOMEPATH%\gOEYMkgs\zkgM.exe
- %HOMEPATH%\gOEYMkgs\LoQu.exe
- %HOMEPATH%\gOEYMkgs\ZgAU.exe
- %HOMEPATH%\gOEYMkgs\PQso.exe
- %HOMEPATH%\gOEYMkgs\GIQQ.exe
- %HOMEPATH%\gOEYMkgs\rgIS.exe
- %HOMEPATH%\gOEYMkgs\ooQM.exe
- %HOMEPATH%\gOEYMkgs\osEM.exe
- %HOMEPATH%\gOEYMkgs\hEMw.exe
- %HOMEPATH%\gOEYMkgs\zMIe.exe
- %HOMEPATH%\gOEYMkgs\Eosa.exe
- %HOMEPATH%\gOEYMkgs\GoMg.exe
- %HOMEPATH%\gOEYMkgs\Powq.exe
- %HOMEPATH%\gOEYMkgs\uoQi.exe
- %HOMEPATH%\gOEYMkgs\egEc.exe
- %HOMEPATH%\gOEYMkgs\kwUa.exe
- %HOMEPATH%\gOEYMkgs\VsUa.exe
- %HOMEPATH%\gOEYMkgs\XEAc.exe
- %HOMEPATH%\gOEYMkgs\AggA.exe
- %HOMEPATH%\gOEYMkgs\BQwg.exe
- %HOMEPATH%\gOEYMkgs\KoQg.exe
- %HOMEPATH%\gOEYMkgs\uswi.exe
- %HOMEPATH%\gOEYMkgs\kQkE.exe
- %HOMEPATH%\gOEYMkgs\loEO.exe
- %HOMEPATH%\gOEYMkgs\AEca.exe
- %HOMEPATH%\gOEYMkgs\XMAe.exe
- %HOMEPATH%\gOEYMkgs\nkcE.exe
- %HOMEPATH%\gOEYMkgs\foAu.exe
- %HOMEPATH%\gOEYMkgs\boYE.exe
- %HOMEPATH%\gOEYMkgs\yIcs.exe
- %HOMEPATH%\gOEYMkgs\fUse.exe
- %HOMEPATH%\gOEYMkgs\DswW.exe
- %HOMEPATH%\gOEYMkgs\HIIq.exe
- %HOMEPATH%\gOEYMkgs\dIIQ.exe
- %HOMEPATH%\gOEYMkgs\Mkkc.exe
- %HOMEPATH%\gOEYMkgs\MsUy.exe
- %HOMEPATH%\gOEYMkgs\QAQI.exe
- %HOMEPATH%\gOEYMkgs\wgAW.exe
- %HOMEPATH%\gOEYMkgs\JQMW.exe
- %HOMEPATH%\gOEYMkgs\yUYc.exe
- %HOMEPATH%\gOEYMkgs\bsQw.exe
- %HOMEPATH%\gOEYMkgs\Jkse.exe
- %HOMEPATH%\gOEYMkgs\Jckc.exe
- %HOMEPATH%\gOEYMkgs\zcMC.exe
- %HOMEPATH%\gOEYMkgs\DIcE.exe
- %HOMEPATH%\gOEYMkgs\PUoK.exe
- %HOMEPATH%\gOEYMkgs\Mska.exe
- %HOMEPATH%\gOEYMkgs\TYgM.exe
- %HOMEPATH%\gOEYMkgs\doIi.exe
- %HOMEPATH%\gOEYMkgs\rYMI.exe
- %HOMEPATH%\gOEYMkgs\CUkk.exe
- %HOMEPATH%\gOEYMkgs\RkEm.exe
- %HOMEPATH%\gOEYMkgs\wsAI.exe
- %HOMEPATH%\gOEYMkgs\MMkM.exe
- %HOMEPATH%\gOEYMkgs\eEoG.exe
- %HOMEPATH%\gOEYMkgs\NEke.exe
- %HOMEPATH%\gOEYMkgs\sYAC.exe
- %HOMEPATH%\gOEYMkgs\tMIS.exe
- %HOMEPATH%\gOEYMkgs\rMAs.exe
- %HOMEPATH%\gOEYMkgs\fogo.exe
- %HOMEPATH%\gOEYMkgs\LMsm.exe
- %HOMEPATH%\gOEYMkgs\yQoQ.exe
- %HOMEPATH%\gOEYMkgs\jkYC.exe
- %HOMEPATH%\gOEYMkgs\dswG.exe
- %HOMEPATH%\gOEYMkgs\NUkA.exe
- %HOMEPATH%\gOEYMkgs\zUwQ.exe
- %HOMEPATH%\gOEYMkgs\AgIO.exe
- %HOMEPATH%\gOEYMkgs\WEMI.exe
- %HOMEPATH%\gOEYMkgs\McAI.exe
- %HOMEPATH%\gOEYMkgs\XAow.exe
- %HOMEPATH%\gOEYMkgs\pIAO.exe
- %HOMEPATH%\gOEYMkgs\FYYy.exe
- %HOMEPATH%\gOEYMkgs\OkIo.exe
- %HOMEPATH%\gOEYMkgs\mwoO.exe
- %HOMEPATH%\gOEYMkgs\yQky.exe
- %HOMEPATH%\gOEYMkgs\REIg.exe
- %HOMEPATH%\gOEYMkgs\HsEG.exe
- %HOMEPATH%\gOEYMkgs\GAsW.exe
- %HOMEPATH%\gOEYMkgs\nUoq.exe
- %HOMEPATH%\gOEYMkgs\VQwM.exe
- %HOMEPATH%\gOEYMkgs\TMIE.exe
- %HOMEPATH%\gOEYMkgs\WkMm.exe
- %HOMEPATH%\gOEYMkgs\uUMO.exe
- %HOMEPATH%\gOEYMkgs\IYQQ.exe
- %HOMEPATH%\gOEYMkgs\Ycog.exe
- %HOMEPATH%\gOEYMkgs\sIUG.exe
- %HOMEPATH%\gOEYMkgs\yMgi.exe
- %HOMEPATH%\gOEYMkgs\MUkq.exe
- %HOMEPATH%\gOEYMkgs\yUwi.exe
- %HOMEPATH%\gOEYMkgs\aIAy.exe
- %HOMEPATH%\gOEYMkgs\iQMM.exe
- %HOMEPATH%\gOEYMkgs\AIoe.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %HOMEPATH%\gOEYMkgs\mMsK.exe
- %HOMEPATH%\gOEYMkgs\zcIW.exe
- %HOMEPATH%\gOEYMkgs\FIcm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %HOMEPATH%\gOEYMkgs\aEoS.exe
- %HOMEPATH%\gOEYMkgs\ZYYS.exe
- %HOMEPATH%\gOEYMkgs\JAIe.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %HOMEPATH%\gOEYMkgs\zEwa.exe
- %HOMEPATH%\gOEYMkgs\RUkU.exe
- %HOMEPATH%\gOEYMkgs\YQoS.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %HOMEPATH%\gOEYMkgs\TEUM.exe
- %TEMP%\WER1f29.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER1f29.dir00\ZgMYMIIE.exe.mdmp
- %TEMP%\WER1f29.dir00\appcompat.txt
- %TEMP%\WER8ad4.dir00\ZgMYMIIE.exe.mdmp
- %TEMP%\WER1f29.dir00\manifest.txt
- %ALLUSERSPROFILE%\caQc.txt
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %TEMP%\WER8ad4.dir00\ZgMYMIIE.exe.hdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %HOMEPATH%\gOEYMkgs\NIIY.exe
- %HOMEPATH%\gOEYMkgs\vcMG.exe
- %HOMEPATH%\gOEYMkgs\qQYO.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %TEMP%\WER8ad4.dir00\manifest.txt
- %TEMP%\WER8ad4.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\JEAA.exe
- %HOMEPATH%\gOEYMkgs\GEca.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %HOMEPATH%\gOEYMkgs\KMAW.exe
- %HOMEPATH%\gOEYMkgs\fMwg.exe
- %HOMEPATH%\gOEYMkgs\xQwY.exe
- %HOMEPATH%\gOEYMkgs\sgYC.exe
- %HOMEPATH%\gOEYMkgs\yUYK.exe
- %HOMEPATH%\gOEYMkgs\dAoC.exe
- %HOMEPATH%\gOEYMkgs\PIAa.exe
- %HOMEPATH%\gOEYMkgs\yQgU.exe
- %HOMEPATH%\gOEYMkgs\NcQu.exe
- %HOMEPATH%\gOEYMkgs\EQcs.exe
- %HOMEPATH%\gOEYMkgs\awkK.exe
- %HOMEPATH%\gOEYMkgs\fEQc.exe
- %HOMEPATH%\gOEYMkgs\IcUY.exe
- %HOMEPATH%\gOEYMkgs\aYEM.exe
- %HOMEPATH%\gOEYMkgs\hgsQ.exe
- %HOMEPATH%\gOEYMkgs\NkcI.exe
- %HOMEPATH%\gOEYMkgs\OoQU.exe
- %HOMEPATH%\gOEYMkgs\oEsa.exe
- %HOMEPATH%\gOEYMkgs\TYsu.exe
- %HOMEPATH%\gOEYMkgs\kYQm.exe
- %HOMEPATH%\gOEYMkgs\VYwY.exe
- %HOMEPATH%\gOEYMkgs\KcME.exe
- %HOMEPATH%\gOEYMkgs\UsUI.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\ngoc.exe
- %HOMEPATH%\gOEYMkgs\OEMe.exe
- %HOMEPATH%\gOEYMkgs\ygQM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %HOMEPATH%\gOEYMkgs\OMIu.exe
- %HOMEPATH%\gOEYMkgs\Qwwg.exe
- %HOMEPATH%\gOEYMkgs\QEgG.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %HOMEPATH%\gOEYMkgs\iwcY.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %HOMEPATH%\gOEYMkgs\tYkI.exe
- %HOMEPATH%\gOEYMkgs\sQke.exe
- %HOMEPATH%\gOEYMkgs\TcsC.exe
- %HOMEPATH%\gOEYMkgs\BAUu.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %HOMEPATH%\gOEYMkgs\eocU.exe
- C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\IcsO.exe
Удаляет следующие файлы:
- %HOMEPATH%\gOEYMkgs\Powq.exe
- %HOMEPATH%\gOEYMkgs\Eosa.exe
- %HOMEPATH%\gOEYMkgs\uoQi.exe
- %HOMEPATH%\gOEYMkgs\egEc.exe
- %HOMEPATH%\gOEYMkgs\GoMg.exe
- %HOMEPATH%\gOEYMkgs\KoQg.exe
- %HOMEPATH%\gOEYMkgs\AggA.exe
- %HOMEPATH%\gOEYMkgs\kwUa.exe
- %HOMEPATH%\gOEYMkgs\BQwg.exe
- %HOMEPATH%\gOEYMkgs\McAI.exe
- %HOMEPATH%\gOEYMkgs\OkIo.exe
- %HOMEPATH%\gOEYMkgs\XAow.exe
- %HOMEPATH%\gOEYMkgs\WEMI.exe
- %HOMEPATH%\gOEYMkgs\HsEG.exe
- %HOMEPATH%\gOEYMkgs\mwoO.exe
- %HOMEPATH%\gOEYMkgs\yQky.exe
- %HOMEPATH%\gOEYMkgs\GAsW.exe
- %HOMEPATH%\gOEYMkgs\REIg.exe
- %HOMEPATH%\gOEYMkgs\ooQM.exe
- %HOMEPATH%\gOEYMkgs\GIQQ.exe
- %HOMEPATH%\gOEYMkgs\osEM.exe
- %HOMEPATH%\gOEYMkgs\hEMw.exe
- %HOMEPATH%\gOEYMkgs\rgIS.exe
- %HOMEPATH%\gOEYMkgs\MsUy.exe
- %HOMEPATH%\gOEYMkgs\dIIQ.exe
- %HOMEPATH%\gOEYMkgs\QAQI.exe
- %HOMEPATH%\gOEYMkgs\wgAW.exe
- %HOMEPATH%\gOEYMkgs\zMIe.exe
- %HOMEPATH%\gOEYMkgs\LoQu.exe
- %HOMEPATH%\gOEYMkgs\VsUa.exe
- %HOMEPATH%\gOEYMkgs\XEAc.exe
- %HOMEPATH%\gOEYMkgs\ZgAU.exe
- %HOMEPATH%\gOEYMkgs\bYAy.exe
- %HOMEPATH%\gOEYMkgs\PQso.exe
- %HOMEPATH%\gOEYMkgs\zkgM.exe
- %HOMEPATH%\gOEYMkgs\vAos.exe
- %HOMEPATH%\gOEYMkgs\FYYy.exe
- %HOMEPATH%\gOEYMkgs\NEke.exe
- %HOMEPATH%\gOEYMkgs\TYgM.exe
- %HOMEPATH%\gOEYMkgs\jkYC.exe
- %HOMEPATH%\gOEYMkgs\dswG.exe
- %HOMEPATH%\gOEYMkgs\doIi.exe
- %HOMEPATH%\gOEYMkgs\PUoK.exe
- %HOMEPATH%\gOEYMkgs\rYMI.exe
- %HOMEPATH%\gOEYMkgs\Mska.exe
- %HOMEPATH%\gOEYMkgs\DIcE.exe
- %HOMEPATH%\gOEYMkgs\rMAs.exe
- %HOMEPATH%\gOEYMkgs\sYAC.exe
- %HOMEPATH%\gOEYMkgs\fogo.exe
- %HOMEPATH%\gOEYMkgs\LMsm.exe
- %HOMEPATH%\gOEYMkgs\tMIS.exe
- %HOMEPATH%\gOEYMkgs\AgIO.exe
- %HOMEPATH%\gOEYMkgs\NUkA.exe
- %HOMEPATH%\gOEYMkgs\yQoQ.exe
- %HOMEPATH%\gOEYMkgs\zUwQ.exe
- %HOMEPATH%\gOEYMkgs\yUwi.exe
- %HOMEPATH%\gOEYMkgs\aIAy.exe
- %HOMEPATH%\gOEYMkgs\TMIE.exe
- %HOMEPATH%\gOEYMkgs\Ycog.exe
- %HOMEPATH%\gOEYMkgs\MUkq.exe
- %HOMEPATH%\gOEYMkgs\nUoq.exe
- %HOMEPATH%\gOEYMkgs\pIAO.exe
- %HOMEPATH%\gOEYMkgs\sIUG.exe
- %HOMEPATH%\gOEYMkgs\yMgi.exe
- %HOMEPATH%\gOEYMkgs\wsAI.exe
- %HOMEPATH%\gOEYMkgs\CUkk.exe
- %HOMEPATH%\gOEYMkgs\MMkM.exe
- %HOMEPATH%\gOEYMkgs\eEoG.exe
- %HOMEPATH%\gOEYMkgs\RkEm.exe
- %HOMEPATH%\gOEYMkgs\WkMm.exe
- %HOMEPATH%\gOEYMkgs\VQwM.exe
- %HOMEPATH%\gOEYMkgs\uUMO.exe
- %HOMEPATH%\gOEYMkgs\IYQQ.exe
- %HOMEPATH%\gOEYMkgs\Mkkc.exe
- %HOMEPATH%\gOEYMkgs\IcsO.exe
- %HOMEPATH%\gOEYMkgs\eocU.exe
- <SYSTEM32>\shell32.dll
- %HOMEPATH%\gOEYMkgs\BAUu.exe
- %HOMEPATH%\gOEYMkgs\ygQM.exe
- %HOMEPATH%\gOEYMkgs\QEgG.exe
- %HOMEPATH%\gOEYMkgs\Qwwg.exe
- %HOMEPATH%\gOEYMkgs\OEMe.exe
- %HOMEPATH%\gOEYMkgs\ngoc.exe
- %HOMEPATH%\gOEYMkgs\NcQu.exe
- %HOMEPATH%\gOEYMkgs\PIAa.exe
- %HOMEPATH%\gOEYMkgs\EQcs.exe
- %HOMEPATH%\gOEYMkgs\awkK.exe
- %HOMEPATH%\gOEYMkgs\yQgU.exe
- %HOMEPATH%\gOEYMkgs\tYkI.exe
- %HOMEPATH%\gOEYMkgs\iwcY.exe
- %HOMEPATH%\gOEYMkgs\sQke.exe
- %HOMEPATH%\gOEYMkgs\TcsC.exe
- %HOMEPATH%\gOEYMkgs\FIcm.exe
- %HOMEPATH%\gOEYMkgs\qQYO.exe
- %HOMEPATH%\gOEYMkgs\zcIW.exe
- %HOMEPATH%\gOEYMkgs\aEoS.exe
- %HOMEPATH%\gOEYMkgs\vcMG.exe
- %HOMEPATH%\gOEYMkgs\JEAA.exe
- %TEMP%\USssgsMI.bat
- %HOMEPATH%\gOEYMkgs\NIIY.exe
- %HOMEPATH%\gOEYMkgs\GEca.exe
- %HOMEPATH%\gOEYMkgs\JAIe.exe
- %HOMEPATH%\gOEYMkgs\RUkU.exe
- %HOMEPATH%\gOEYMkgs\OMIu.exe
- %HOMEPATH%\gOEYMkgs\zEwa.exe
- %HOMEPATH%\gOEYMkgs\TEUM.exe
- %HOMEPATH%\gOEYMkgs\mMsK.exe
- %HOMEPATH%\gOEYMkgs\AIoe.exe
- %HOMEPATH%\gOEYMkgs\YQoS.exe
- %HOMEPATH%\gOEYMkgs\ZYYS.exe
- %HOMEPATH%\gOEYMkgs\dAoC.exe
- %HOMEPATH%\gOEYMkgs\kQkE.exe
- %HOMEPATH%\gOEYMkgs\nkcE.exe
- %HOMEPATH%\gOEYMkgs\loEO.exe
- %HOMEPATH%\gOEYMkgs\uswi.exe
- %HOMEPATH%\gOEYMkgs\fUse.exe
- %HOMEPATH%\gOEYMkgs\foAu.exe
- %HOMEPATH%\gOEYMkgs\boYE.exe
- %HOMEPATH%\gOEYMkgs\DswW.exe
- %HOMEPATH%\gOEYMkgs\yIcs.exe
- %HOMEPATH%\gOEYMkgs\zcMC.exe
- %HOMEPATH%\gOEYMkgs\Jkse.exe
- %HOMEPATH%\gOEYMkgs\JQMW.exe
- %HOMEPATH%\gOEYMkgs\Jckc.exe
- %HOMEPATH%\gOEYMkgs\yUYc.exe
- %HOMEPATH%\gOEYMkgs\AEca.exe
- %HOMEPATH%\gOEYMkgs\XMAe.exe
- %HOMEPATH%\gOEYMkgs\bsQw.exe
- %HOMEPATH%\gOEYMkgs\HIIq.exe
- %HOMEPATH%\gOEYMkgs\kYQm.exe
- %HOMEPATH%\gOEYMkgs\fEQc.exe
- %HOMEPATH%\gOEYMkgs\VYwY.exe
- %HOMEPATH%\gOEYMkgs\TYsu.exe
- %HOMEPATH%\gOEYMkgs\sgYC.exe
- %HOMEPATH%\gOEYMkgs\KMAW.exe
- %HOMEPATH%\gOEYMkgs\fMwg.exe
- %HOMEPATH%\gOEYMkgs\yUYK.exe
- %HOMEPATH%\gOEYMkgs\xQwY.exe
- %HOMEPATH%\gOEYMkgs\OoQU.exe
- %HOMEPATH%\gOEYMkgs\hgsQ.exe
- %HOMEPATH%\gOEYMkgs\iQMM.exe
- %HOMEPATH%\gOEYMkgs\NkcI.exe
- %HOMEPATH%\gOEYMkgs\IcUY.exe
- %HOMEPATH%\gOEYMkgs\KcME.exe
- %HOMEPATH%\gOEYMkgs\UsUI.exe
- %HOMEPATH%\gOEYMkgs\aYEM.exe
- %HOMEPATH%\gOEYMkgs\oEsa.exe
Сетевая активность:
UDP:
- DNS ASK google.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'lacMcYws.exe'
