Trojan.MulDrop7.35776

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Заражает следующие исполняемые файлы:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Запускает на исполнение:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cmd.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\WER2b70.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\HQAs.exe
%HOMEPATH%\gOEYMkgs\PIUw.exe
%HOMEPATH%\gOEYMkgs\QYEc.exe
%HOMEPATH%\gOEYMkgs\xAwO.exe
%HOMEPATH%\gOEYMkgs\tYYW.exe
%HOMEPATH%\gOEYMkgs\LMko.exe
%HOMEPATH%\gOEYMkgs\xwAe.exe
%TEMP%\WER2b70.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\Nswo.exe
%HOMEPATH%\gOEYMkgs\bAgg.exe
%HOMEPATH%\gOEYMkgs\AUYG.exe
%HOMEPATH%\gOEYMkgs\dkkq.exe
%HOMEPATH%\gOEYMkgs\KwQo.exe
%HOMEPATH%\gOEYMkgs\gYck.exe
%HOMEPATH%\gOEYMkgs\dkEM.exe
%HOMEPATH%\gOEYMkgs\ogAS.exe
%HOMEPATH%\gOEYMkgs\awkY.exe
%HOMEPATH%\gOEYMkgs\KYgC.exe
%HOMEPATH%\gOEYMkgs\iYQM.exe
%HOMEPATH%\gOEYMkgs\Okou.exe
%TEMP%\WER2b70.dir00\manifest.txt
%TEMP%\WER2b70.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\ooYC.exe
%HOMEPATH%\gOEYMkgs\YMIy.exe
%HOMEPATH%\gOEYMkgs\lMQw.exe
%HOMEPATH%\gOEYMkgs\yQUe.exe
%HOMEPATH%\gOEYMkgs\OoEa.exe
%HOMEPATH%\gOEYMkgs\yMAW.exe
%HOMEPATH%\gOEYMkgs\jEgM.exe
%HOMEPATH%\gOEYMkgs\swMm.exe
%HOMEPATH%\gOEYMkgs\cUkM.exe
%HOMEPATH%\gOEYMkgs\JoEs.exe
%HOMEPATH%\gOEYMkgs\Lckg.exe
%HOMEPATH%\gOEYMkgs\FoQo.exe
%HOMEPATH%\gOEYMkgs\kMcw.exe
%HOMEPATH%\gOEYMkgs\RkkY.exe
%HOMEPATH%\gOEYMkgs\QIgE.exe
%HOMEPATH%\gOEYMkgs\ZsMC.exe
%HOMEPATH%\gOEYMkgs\Fcoi.exe
%HOMEPATH%\gOEYMkgs\NcMw.exe
%HOMEPATH%\gOEYMkgs\uoEA.exe
%HOMEPATH%\gOEYMkgs\DAQg.exe
%HOMEPATH%\gOEYMkgs\ooAG.exe
%HOMEPATH%\gOEYMkgs\cwEK.exe
%HOMEPATH%\gOEYMkgs\nMYw.exe
%HOMEPATH%\gOEYMkgs\RQEo.exe
%HOMEPATH%\gOEYMkgs\jUUO.exe
%HOMEPATH%\gOEYMkgs\TcAc.exe
%HOMEPATH%\gOEYMkgs\xYkE.exe
%HOMEPATH%\gOEYMkgs\nokg.exe
%HOMEPATH%\gOEYMkgs\xIIM.exe
%HOMEPATH%\gOEYMkgs\rUUy.exe
%HOMEPATH%\gOEYMkgs\qskg.exe
%HOMEPATH%\gOEYMkgs\TEsS.exe
%HOMEPATH%\gOEYMkgs\voEa.exe
%HOMEPATH%\gOEYMkgs\MAsI.exe
%HOMEPATH%\gOEYMkgs\LkkI.exe
%HOMEPATH%\gOEYMkgs\zQMw.exe
%HOMEPATH%\gOEYMkgs\LkoM.exe
%HOMEPATH%\gOEYMkgs\MIMW.exe
%HOMEPATH%\gOEYMkgs\iAgw.exe
%HOMEPATH%\gOEYMkgs\JwYa.exe
%HOMEPATH%\gOEYMkgs\QwQK.exe
%HOMEPATH%\gOEYMkgs\CQUs.exe
%HOMEPATH%\gOEYMkgs\MkYI.exe
%TEMP%\WER1c93.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER1c93.dir00\ZgMYMIIE.exe.mdmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
%TEMP%\WER1c93.dir00\manifest.txt
%TEMP%\WER1c93.dir00\appcompat.txt
%TEMP%\WERa7c4.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\xIUs.exe
%HOMEPATH%\gOEYMkgs\AwQc.exe
%HOMEPATH%\gOEYMkgs\pIkk.exe
%TEMP%\WERa7c4.dir00\appcompat.txt
%TEMP%\WERa7c4.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WERa7c4.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\mcsU.exe
%HOMEPATH%\gOEYMkgs\GYYk.exe
%HOMEPATH%\gOEYMkgs\OcIw.exe
%HOMEPATH%\gOEYMkgs\SIAu.exe
%HOMEPATH%\gOEYMkgs\eIoC.exe
%HOMEPATH%\gOEYMkgs\vcwa.exe
%HOMEPATH%\gOEYMkgs\ucQg.exe
%HOMEPATH%\gOEYMkgs\QUYo.exe
%HOMEPATH%\gOEYMkgs\iAEi.exe
%HOMEPATH%\gOEYMkgs\RMQi.exe
%HOMEPATH%\gOEYMkgs\FAEM.exe
%HOMEPATH%\gOEYMkgs\qsMq.exe
%HOMEPATH%\gOEYMkgs\RIcm.exe
%HOMEPATH%\gOEYMkgs\yIcQ.exe
%HOMEPATH%\gOEYMkgs\FIMS.exe
%HOMEPATH%\gOEYMkgs\CsIy.exe
%HOMEPATH%\gOEYMkgs\Iswg.exe
%HOMEPATH%\gOEYMkgs\EwMW.exe
%HOMEPATH%\gOEYMkgs\kMsQ.exe
%HOMEPATH%\gOEYMkgs\ZcgA.exe
%HOMEPATH%\gOEYMkgs\sgwo.exe
%HOMEPATH%\gOEYMkgs\akoc.exe
%HOMEPATH%\gOEYMkgs\hgYe.exe
%HOMEPATH%\gOEYMkgs\qswa.exe
%HOMEPATH%\gOEYMkgs\uEIy.exe
%HOMEPATH%\gOEYMkgs\AwIk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\BwwA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\hEEO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\icYC.exe
%HOMEPATH%\gOEYMkgs\NckS.exe
%HOMEPATH%\gOEYMkgs\yIwW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\uAUa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\eEgY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\eAgS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\kYEK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\dwwy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\nosQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\kMEi.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\ToEO.exe
%TEMP%\WER460e.dir00\manifest.txt
%TEMP%\WER460e.dir00\appcompat.txt
%TEMP%\WER460e.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\fsoe.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\Yosc.exe
%TEMP%\WER460e.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\QAwO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\WEEs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%HOMEPATH%\gOEYMkgs\TswO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\DQAy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\uQEO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\JQEs.exe
%HOMEPATH%\gOEYMkgs\Ygsg.exe
%HOMEPATH%\gOEYMkgs\GUYK.exe
%HOMEPATH%\gOEYMkgs\GsAA.exe
%HOMEPATH%\gOEYMkgs\FEkA.exe
%HOMEPATH%\gOEYMkgs\iskM.exe
%HOMEPATH%\gOEYMkgs\vEQy.exe
%HOMEPATH%\gOEYMkgs\vIII.exe
%HOMEPATH%\gOEYMkgs\SAMI.exe
%HOMEPATH%\gOEYMkgs\qscw.exe
%HOMEPATH%\gOEYMkgs\ekYe.exe
%HOMEPATH%\gOEYMkgs\AsIs.exe
%HOMEPATH%\gOEYMkgs\zgAU.exe
%HOMEPATH%\gOEYMkgs\mAYk.exe
%HOMEPATH%\gOEYMkgs\WIEI.exe
%HOMEPATH%\gOEYMkgs\tUMI.exe
%HOMEPATH%\gOEYMkgs\VcgM.exe
%HOMEPATH%\gOEYMkgs\bwQo.exe
%HOMEPATH%\gOEYMkgs\AUge.exe
%HOMEPATH%\gOEYMkgs\BcMU.exe
%HOMEPATH%\gOEYMkgs\aYYe.exe
%HOMEPATH%\gOEYMkgs\lwko.exe
%HOMEPATH%\gOEYMkgs\Tgku.exe
%HOMEPATH%\gOEYMkgs\QYMC.exe
%HOMEPATH%\gOEYMkgs\rcEi.exe
%HOMEPATH%\gOEYMkgs\ngkc.exe
%HOMEPATH%\gOEYMkgs\UwUe.exe
%HOMEPATH%\gOEYMkgs\Cgky.exe
%HOMEPATH%\gOEYMkgs\ykcA.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\sgcq.exe
%HOMEPATH%\gOEYMkgs\Pkkg.exe
<Текущая директория>\<Имя файла>
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\KgYy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\tQoc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\oIgC.exe
%TEMP%\WERbbfd.dir00\appcompat.txt
%TEMP%\WERbbfd.dir00\ZgMYMIIE.exe.hdmp
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\tAYq.exe
%HOMEPATH%\gOEYMkgs\gEAc.exe
%TEMP%\WERbbfd.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\Fwwo.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%HOMEPATH%\gOEYMkgs\mkIc.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%TEMP%\WERbbfd.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\fAYe.exe

Удаляет следующие файлы:

%HOMEPATH%\gOEYMkgs\iYQM.exe
%HOMEPATH%\gOEYMkgs\ooYC.exe
%HOMEPATH%\gOEYMkgs\gYck.exe
%HOMEPATH%\gOEYMkgs\dkEM.exe
%HOMEPATH%\gOEYMkgs\YMIy.exe
%HOMEPATH%\gOEYMkgs\QYEc.exe
%HOMEPATH%\gOEYMkgs\xAwO.exe
%HOMEPATH%\gOEYMkgs\lMQw.exe
%HOMEPATH%\gOEYMkgs\Okou.exe
%HOMEPATH%\gOEYMkgs\iAEi.exe
%HOMEPATH%\gOEYMkgs\RMQi.exe
%HOMEPATH%\gOEYMkgs\RIcm.exe
%HOMEPATH%\gOEYMkgs\QUYo.exe
%HOMEPATH%\gOEYMkgs\rUUy.exe
%HOMEPATH%\gOEYMkgs\KYgC.exe
%HOMEPATH%\gOEYMkgs\KwQo.exe
%HOMEPATH%\gOEYMkgs\ogAS.exe
%HOMEPATH%\gOEYMkgs\awkY.exe
%HOMEPATH%\gOEYMkgs\tYYW.exe
%HOMEPATH%\gOEYMkgs\Fcoi.exe
%HOMEPATH%\gOEYMkgs\NcMw.exe
%HOMEPATH%\gOEYMkgs\ooAG.exe
%HOMEPATH%\gOEYMkgs\cwEK.exe
%HOMEPATH%\gOEYMkgs\uoEA.exe
%HOMEPATH%\gOEYMkgs\nokg.exe
%HOMEPATH%\gOEYMkgs\xIIM.exe
%HOMEPATH%\gOEYMkgs\nMYw.exe
%HOMEPATH%\gOEYMkgs\xYkE.exe
%HOMEPATH%\gOEYMkgs\LMko.exe
%HOMEPATH%\gOEYMkgs\bAgg.exe
%HOMEPATH%\gOEYMkgs\HQAs.exe
%HOMEPATH%\gOEYMkgs\PIUw.exe
%HOMEPATH%\gOEYMkgs\AUYG.exe
%HOMEPATH%\gOEYMkgs\Nswo.exe
%HOMEPATH%\gOEYMkgs\DAQg.exe
%HOMEPATH%\gOEYMkgs\dkkq.exe
%HOMEPATH%\gOEYMkgs\xwAe.exe
%HOMEPATH%\gOEYMkgs\qsMq.exe
%HOMEPATH%\gOEYMkgs\CQUs.exe
%HOMEPATH%\gOEYMkgs\MkYI.exe
%HOMEPATH%\gOEYMkgs\LkoM.exe
%HOMEPATH%\gOEYMkgs\QwQK.exe
%HOMEPATH%\gOEYMkgs\MIMW.exe
%HOMEPATH%\gOEYMkgs\Iswg.exe
%HOMEPATH%\gOEYMkgs\EwMW.exe
%HOMEPATH%\gOEYMkgs\iAgw.exe
%HOMEPATH%\gOEYMkgs\JwYa.exe
%HOMEPATH%\gOEYMkgs\pIkk.exe
%HOMEPATH%\gOEYMkgs\MAsI.exe
%HOMEPATH%\gOEYMkgs\xIUs.exe
%HOMEPATH%\gOEYMkgs\AwQc.exe
%HOMEPATH%\gOEYMkgs\LkkI.exe
%HOMEPATH%\gOEYMkgs\TEsS.exe
%HOMEPATH%\gOEYMkgs\voEa.exe
%HOMEPATH%\gOEYMkgs\zQMw.exe
%HOMEPATH%\gOEYMkgs\qskg.exe
%HOMEPATH%\gOEYMkgs\kMsQ.exe
%HOMEPATH%\gOEYMkgs\eIoC.exe
%HOMEPATH%\gOEYMkgs\vcwa.exe
%HOMEPATH%\gOEYMkgs\hgYe.exe
%HOMEPATH%\gOEYMkgs\SIAu.exe
%HOMEPATH%\gOEYMkgs\mcsU.exe
%HOMEPATH%\gOEYMkgs\ucQg.exe
%HOMEPATH%\gOEYMkgs\FAEM.exe
%HOMEPATH%\gOEYMkgs\GYYk.exe
%HOMEPATH%\gOEYMkgs\OcIw.exe
%HOMEPATH%\gOEYMkgs\CsIy.exe
%HOMEPATH%\gOEYMkgs\ZcgA.exe
%HOMEPATH%\gOEYMkgs\yIcQ.exe
%HOMEPATH%\gOEYMkgs\FIMS.exe
%HOMEPATH%\gOEYMkgs\qswa.exe
%HOMEPATH%\gOEYMkgs\sgwo.exe
%HOMEPATH%\gOEYMkgs\akoc.exe
%HOMEPATH%\gOEYMkgs\uEIy.exe
%HOMEPATH%\gOEYMkgs\AwIk.exe
%HOMEPATH%\gOEYMkgs\RQEo.exe
%HOMEPATH%\gOEYMkgs\sgcq.exe
%HOMEPATH%\gOEYMkgs\tQoc.exe
%TEMP%\WmsooMEQ.bat
%HOMEPATH%\gOEYMkgs\ykcA.exe
%HOMEPATH%\gOEYMkgs\oIgC.exe
%HOMEPATH%\gOEYMkgs\dwwy.exe
%HOMEPATH%\gOEYMkgs\eAgS.exe
%HOMEPATH%\gOEYMkgs\KgYy.exe
%HOMEPATH%\gOEYMkgs\Ygsg.exe
%HOMEPATH%\gOEYMkgs\AsIs.exe
%HOMEPATH%\gOEYMkgs\tAYq.exe
%HOMEPATH%\gOEYMkgs\qscw.exe
%HOMEPATH%\gOEYMkgs\ekYe.exe
%HOMEPATH%\gOEYMkgs\gEAc.exe
%HOMEPATH%\gOEYMkgs\mkIc.exe
%HOMEPATH%\gOEYMkgs\Pkkg.exe
%HOMEPATH%\gOEYMkgs\Fwwo.exe
%HOMEPATH%\gOEYMkgs\fAYe.exe
%HOMEPATH%\gOEYMkgs\kYEK.exe
%HOMEPATH%\gOEYMkgs\QAwO.exe
%HOMEPATH%\gOEYMkgs\WEEs.exe
%HOMEPATH%\gOEYMkgs\uAUa.exe
%HOMEPATH%\gOEYMkgs\TswO.exe
%HOMEPATH%\gOEYMkgs\uQEO.exe
%HOMEPATH%\gOEYMkgs\fsoe.exe
%HOMEPATH%\gOEYMkgs\Yosc.exe
%HOMEPATH%\gOEYMkgs\JQEs.exe
%HOMEPATH%\gOEYMkgs\DQAy.exe
%HOMEPATH%\gOEYMkgs\nosQ.exe
%HOMEPATH%\gOEYMkgs\hEEO.exe
%HOMEPATH%\gOEYMkgs\kMEi.exe
%HOMEPATH%\gOEYMkgs\ToEO.exe
%HOMEPATH%\gOEYMkgs\icYC.exe
%HOMEPATH%\gOEYMkgs\eEgY.exe
%HOMEPATH%\gOEYMkgs\yIwW.exe
%HOMEPATH%\gOEYMkgs\BwwA.exe
%HOMEPATH%\gOEYMkgs\NckS.exe
%HOMEPATH%\gOEYMkgs\WIEI.exe
%HOMEPATH%\gOEYMkgs\ZsMC.exe
%HOMEPATH%\gOEYMkgs\Lckg.exe
%HOMEPATH%\gOEYMkgs\RkkY.exe
%HOMEPATH%\gOEYMkgs\QIgE.exe
%HOMEPATH%\gOEYMkgs\FoQo.exe
%HOMEPATH%\gOEYMkgs\BcMU.exe
%HOMEPATH%\gOEYMkgs\aYYe.exe
%HOMEPATH%\gOEYMkgs\kMcw.exe
%HOMEPATH%\gOEYMkgs\AUge.exe
%HOMEPATH%\gOEYMkgs\jEgM.exe
%HOMEPATH%\gOEYMkgs\swMm.exe
%HOMEPATH%\gOEYMkgs\jUUO.exe
%HOMEPATH%\gOEYMkgs\TcAc.exe
%HOMEPATH%\gOEYMkgs\cUkM.exe
%HOMEPATH%\gOEYMkgs\yMAW.exe
%HOMEPATH%\gOEYMkgs\JoEs.exe
%HOMEPATH%\gOEYMkgs\yQUe.exe
%HOMEPATH%\gOEYMkgs\OoEa.exe
%HOMEPATH%\gOEYMkgs\tUMI.exe
%HOMEPATH%\gOEYMkgs\vIII.exe
%HOMEPATH%\gOEYMkgs\GUYK.exe
%HOMEPATH%\gOEYMkgs\iskM.exe
%HOMEPATH%\gOEYMkgs\vEQy.exe
%HOMEPATH%\gOEYMkgs\GsAA.exe
%HOMEPATH%\gOEYMkgs\zgAU.exe
%HOMEPATH%\gOEYMkgs\mAYk.exe
%HOMEPATH%\gOEYMkgs\FEkA.exe
%HOMEPATH%\gOEYMkgs\SAMI.exe
%HOMEPATH%\gOEYMkgs\lwko.exe
%HOMEPATH%\gOEYMkgs\ngkc.exe
%HOMEPATH%\gOEYMkgs\VcgM.exe
%HOMEPATH%\gOEYMkgs\bwQo.exe
%HOMEPATH%\gOEYMkgs\UwUe.exe
%HOMEPATH%\gOEYMkgs\QYMC.exe
%HOMEPATH%\gOEYMkgs\rcEi.exe
%HOMEPATH%\gOEYMkgs\Cgky.exe
%HOMEPATH%\gOEYMkgs\Tgku.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'74.##5.232.51':443
'ap#.###coincharts.com':443
'74.##5.232.51':80

TCP:

Запросы HTTP GET:

http://google.com/ via 74.##5.232.51
http:/// via 74.##5.232.51

UDP:

DNS ASK ma##.google.com
DNS ASK ap#.###coincharts.com
DNS ASK google.com

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'Run'
ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Open'
ClassName: 'WorkerW' WindowName: ''
ClassName: 'DV2ControlHost' WindowName: ''
ClassName: 'BUTTON' WindowName: 'START'
ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'xSMgIcIg'
ClassName: '' WindowName: 'Windows Internet Explorer'
ClassName: '' WindowName: 'Open File'
ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней