Trojan.MulDrop7.35800

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Заражает следующие исполняемые файлы:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Запускает на исполнение:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\gOEYMkgs\NcEM.exe
%HOMEPATH%\gOEYMkgs\okIO.exe
%HOMEPATH%\gOEYMkgs\uAYY.exe
%HOMEPATH%\gOEYMkgs\UYsu.exe
%HOMEPATH%\gOEYMkgs\assG.exe
%HOMEPATH%\gOEYMkgs\soUs.exe
%HOMEPATH%\gOEYMkgs\hogG.exe
%HOMEPATH%\gOEYMkgs\eoAm.exe
%HOMEPATH%\gOEYMkgs\zwQY.exe
%HOMEPATH%\gOEYMkgs\JYwI.exe
%HOMEPATH%\gOEYMkgs\JsIE.exe
%HOMEPATH%\gOEYMkgs\eMMg.exe
%HOMEPATH%\gOEYMkgs\bEcQ.exe
%HOMEPATH%\gOEYMkgs\dYMa.exe
%HOMEPATH%\gOEYMkgs\xgAu.exe
%HOMEPATH%\gOEYMkgs\ZIsU.exe
%HOMEPATH%\gOEYMkgs\DwEu.exe
%HOMEPATH%\gOEYMkgs\NIgU.exe
%HOMEPATH%\gOEYMkgs\zQsW.exe
%HOMEPATH%\gOEYMkgs\xgsa.exe
%HOMEPATH%\gOEYMkgs\CwIG.exe
%HOMEPATH%\gOEYMkgs\fgIo.exe
%HOMEPATH%\gOEYMkgs\HcIy.exe
%HOMEPATH%\gOEYMkgs\jYMI.exe
%HOMEPATH%\gOEYMkgs\sQYO.exe
%HOMEPATH%\gOEYMkgs\eYEY.exe
%TEMP%\WER0a85.dir00\manifest.txt
%TEMP%\WER0a85.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\SYoE.exe
%HOMEPATH%\gOEYMkgs\ewoa.exe
%HOMEPATH%\gOEYMkgs\Dgce.exe
%HOMEPATH%\gOEYMkgs\DYMY.exe
%HOMEPATH%\gOEYMkgs\pAIy.exe
%HOMEPATH%\gOEYMkgs\WYAS.exe
%HOMEPATH%\gOEYMkgs\vAMs.exe
%HOMEPATH%\gOEYMkgs\IwkO.exe
%TEMP%\WER0a85.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\SoMo.exe
%HOMEPATH%\gOEYMkgs\sAou.exe
%HOMEPATH%\gOEYMkgs\BUcq.exe
%HOMEPATH%\gOEYMkgs\iYEU.exe
%HOMEPATH%\gOEYMkgs\tEYI.exe
%HOMEPATH%\gOEYMkgs\sEUc.exe
%HOMEPATH%\gOEYMkgs\KkMq.exe
%HOMEPATH%\gOEYMkgs\BQwQ.exe
%HOMEPATH%\gOEYMkgs\MAoY.exe
%HOMEPATH%\gOEYMkgs\rwEu.exe
%HOMEPATH%\gOEYMkgs\mQQS.exe
%HOMEPATH%\gOEYMkgs\DgUI.exe
%HOMEPATH%\gOEYMkgs\dkUi.exe
%HOMEPATH%\gOEYMkgs\ugYk.exe
%HOMEPATH%\gOEYMkgs\WgYu.exe
%HOMEPATH%\gOEYMkgs\PAko.exe
%HOMEPATH%\gOEYMkgs\zkUg.exe
%HOMEPATH%\gOEYMkgs\gAUs.exe
%HOMEPATH%\gOEYMkgs\dMEa.exe
%HOMEPATH%\gOEYMkgs\DUsO.exe
%HOMEPATH%\gOEYMkgs\hQMu.exe
%HOMEPATH%\gOEYMkgs\dwMk.exe
%TEMP%\WER82c5.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\OIYA.exe
%HOMEPATH%\gOEYMkgs\BAUc.exe
%HOMEPATH%\gOEYMkgs\rIQk.exe
%HOMEPATH%\gOEYMkgs\eEUS.exe
%HOMEPATH%\gOEYMkgs\YoAY.exe
%HOMEPATH%\gOEYMkgs\RowE.exe
%HOMEPATH%\gOEYMkgs\vccM.exe
%HOMEPATH%\gOEYMkgs\AswM.exe
%HOMEPATH%\gOEYMkgs\xwge.exe
%HOMEPATH%\gOEYMkgs\qkEM.exe
%HOMEPATH%\gOEYMkgs\yMIi.exe
%HOMEPATH%\gOEYMkgs\ZoMy.exe
%HOMEPATH%\gOEYMkgs\MAUw.exe
%HOMEPATH%\gOEYMkgs\HsYA.exe
%HOMEPATH%\gOEYMkgs\DYEC.exe
%HOMEPATH%\gOEYMkgs\PgQa.exe
%TEMP%\WER82c5.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\EkoG.exe
%HOMEPATH%\gOEYMkgs\bIQw.exe
%HOMEPATH%\gOEYMkgs\NIQG.exe
%HOMEPATH%\gOEYMkgs\xUUK.exe
%HOMEPATH%\gOEYMkgs\DIcs.exe
%HOMEPATH%\gOEYMkgs\RcAU.exe
%HOMEPATH%\gOEYMkgs\yUEs.exe
%HOMEPATH%\gOEYMkgs\XkEu.exe
%HOMEPATH%\gOEYMkgs\sAQO.exe
%HOMEPATH%\gOEYMkgs\OYEu.exe
%HOMEPATH%\gOEYMkgs\XggI.exe
%HOMEPATH%\gOEYMkgs\OwUs.exe
%HOMEPATH%\gOEYMkgs\SUUa.exe
%HOMEPATH%\gOEYMkgs\rcMO.exe
%HOMEPATH%\gOEYMkgs\aEAs.exe
%HOMEPATH%\gOEYMkgs\KccC.exe
%HOMEPATH%\gOEYMkgs\MkUQ.exe
%HOMEPATH%\gOEYMkgs\oAYi.exe
%TEMP%\WER82c5.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\NwAI.exe
%HOMEPATH%\gOEYMkgs\GkUG.exe
%HOMEPATH%\gOEYMkgs\gMQi.exe
%TEMP%\WER82c5.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\lQwk.exe
%HOMEPATH%\gOEYMkgs\ccIW.exe
%HOMEPATH%\gOEYMkgs\EUgm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\bAMU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\JIkI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%TEMP%\WER9e4a.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\zUAy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\JIYE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%TEMP%\WER9e4a.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\LAEs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\LMgo.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\hUYS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\sUwo.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\UUwU.exe
%TEMP%\WER9e4a.dir00\manifest.txt
%TEMP%\WER9e4a.dir00\appcompat.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\LowY.exe
%TEMP%\WER2036.dir00\appcompat.txt
%TEMP%\WER2036.dir00\ZgMYMIIE.exe.hdmp
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\XsMa.exe
%TEMP%\WER2036.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%TEMP%\WER2036.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\nosa.exe
%HOMEPATH%\gOEYMkgs\WwIc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\BgsA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%HOMEPATH%\gOEYMkgs\Ukcc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\vYIe.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
<Текущая директория>\<Имя файла>
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\ngkI.exe
%HOMEPATH%\gOEYMkgs\UAcu.exe
%HOMEPATH%\gOEYMkgs\MIQo.exe
%HOMEPATH%\gOEYMkgs\xEMO.exe
%HOMEPATH%\gOEYMkgs\qsEy.exe
%HOMEPATH%\gOEYMkgs\gsEc.exe
%HOMEPATH%\gOEYMkgs\xwoc.exe
%HOMEPATH%\gOEYMkgs\rQMw.exe
%HOMEPATH%\gOEYMkgs\DcAI.exe
%HOMEPATH%\gOEYMkgs\SYsw.exe
%HOMEPATH%\gOEYMkgs\KQgk.exe
%HOMEPATH%\gOEYMkgs\iEcI.exe
%HOMEPATH%\gOEYMkgs\SoAy.exe
%HOMEPATH%\gOEYMkgs\esEy.exe
%TEMP%\WER0a85.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\NYsA.exe
%HOMEPATH%\gOEYMkgs\xYIg.exe
%HOMEPATH%\gOEYMkgs\pQYO.exe
%HOMEPATH%\gOEYMkgs\voUE.exe
%HOMEPATH%\gOEYMkgs\Icwe.exe
%HOMEPATH%\gOEYMkgs\xwII.exe
%HOMEPATH%\gOEYMkgs\OIog.exe
%HOMEPATH%\gOEYMkgs\nAIy.exe
%HOMEPATH%\gOEYMkgs\JwcA.exe
%HOMEPATH%\gOEYMkgs\TQkC.exe
%HOMEPATH%\gOEYMkgs\ksMG.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\qgYa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\nwIc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\uccW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\sYwk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\nEIM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\rcEY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%HOMEPATH%\gOEYMkgs\ekEY.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%HOMEPATH%\gOEYMkgs\vMoE.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\DogC.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\HUwq.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\Wocc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%HOMEPATH%\gOEYMkgs\gIcW.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\EIoc.exe

Удаляет следующие файлы:

%HOMEPATH%\gOEYMkgs\zQsW.exe
%HOMEPATH%\gOEYMkgs\dYMa.exe
%HOMEPATH%\gOEYMkgs\DwEu.exe
%HOMEPATH%\gOEYMkgs\NIgU.exe
%HOMEPATH%\gOEYMkgs\xgAu.exe
%HOMEPATH%\gOEYMkgs\jYMI.exe
%HOMEPATH%\gOEYMkgs\sQYO.exe
%HOMEPATH%\gOEYMkgs\ZIsU.exe
%HOMEPATH%\gOEYMkgs\HcIy.exe
%HOMEPATH%\gOEYMkgs\NIQG.exe
%HOMEPATH%\gOEYMkgs\OYEu.exe
%HOMEPATH%\gOEYMkgs\EkoG.exe
%HOMEPATH%\gOEYMkgs\bIQw.exe
%HOMEPATH%\gOEYMkgs\XggI.exe
%HOMEPATH%\gOEYMkgs\XkEu.exe
%HOMEPATH%\gOEYMkgs\sAQO.exe
%HOMEPATH%\gOEYMkgs\OwUs.exe
%HOMEPATH%\gOEYMkgs\yUEs.exe
%HOMEPATH%\gOEYMkgs\xgsa.exe
%HOMEPATH%\gOEYMkgs\eMMg.exe
%HOMEPATH%\gOEYMkgs\hogG.exe
%HOMEPATH%\gOEYMkgs\JYwI.exe
%HOMEPATH%\gOEYMkgs\JsIE.exe
%HOMEPATH%\gOEYMkgs\eoAm.exe
%HOMEPATH%\gOEYMkgs\sEUc.exe
%HOMEPATH%\gOEYMkgs\KkMq.exe
%HOMEPATH%\gOEYMkgs\zwQY.exe
%HOMEPATH%\gOEYMkgs\eYEY.exe
%HOMEPATH%\gOEYMkgs\bEcQ.exe
%HOMEPATH%\gOEYMkgs\UYsu.exe
%HOMEPATH%\gOEYMkgs\CwIG.exe
%HOMEPATH%\gOEYMkgs\fgIo.exe
%HOMEPATH%\gOEYMkgs\assG.exe
%HOMEPATH%\gOEYMkgs\okIO.exe
%HOMEPATH%\gOEYMkgs\uAYY.exe
%HOMEPATH%\gOEYMkgs\soUs.exe
%HOMEPATH%\gOEYMkgs\NcEM.exe
%HOMEPATH%\gOEYMkgs\RcAU.exe
%HOMEPATH%\gOEYMkgs\MAUw.exe
%HOMEPATH%\gOEYMkgs\eEUS.exe
%HOMEPATH%\gOEYMkgs\yMIi.exe
%HOMEPATH%\gOEYMkgs\ZoMy.exe
%HOMEPATH%\gOEYMkgs\gAUs.exe
%HOMEPATH%\gOEYMkgs\WgYu.exe
%HOMEPATH%\gOEYMkgs\PAko.exe
%HOMEPATH%\gOEYMkgs\dMEa.exe
%HOMEPATH%\gOEYMkgs\DUsO.exe
%HOMEPATH%\gOEYMkgs\qkEM.exe
%HOMEPATH%\gOEYMkgs\YoAY.exe
%HOMEPATH%\gOEYMkgs\AswM.exe
%HOMEPATH%\gOEYMkgs\xwge.exe
%HOMEPATH%\gOEYMkgs\RowE.exe
%HOMEPATH%\gOEYMkgs\DYEC.exe
%HOMEPATH%\gOEYMkgs\PgQa.exe
%HOMEPATH%\gOEYMkgs\vccM.exe
%HOMEPATH%\gOEYMkgs\HsYA.exe
%HOMEPATH%\gOEYMkgs\zkUg.exe
%HOMEPATH%\gOEYMkgs\ccIW.exe
%HOMEPATH%\gOEYMkgs\NwAI.exe
%HOMEPATH%\gOEYMkgs\KccC.exe
%HOMEPATH%\gOEYMkgs\lQwk.exe
%HOMEPATH%\gOEYMkgs\GkUG.exe
%HOMEPATH%\gOEYMkgs\xUUK.exe
%HOMEPATH%\gOEYMkgs\DIcs.exe
%HOMEPATH%\gOEYMkgs\gMQi.exe
%HOMEPATH%\gOEYMkgs\SUUa.exe
%HOMEPATH%\gOEYMkgs\rIQk.exe
%HOMEPATH%\gOEYMkgs\hQMu.exe
%HOMEPATH%\gOEYMkgs\OIYA.exe
%HOMEPATH%\gOEYMkgs\BAUc.exe
%HOMEPATH%\gOEYMkgs\dwMk.exe
%HOMEPATH%\gOEYMkgs\rcMO.exe
%HOMEPATH%\gOEYMkgs\aEAs.exe
%HOMEPATH%\gOEYMkgs\MkUQ.exe
%HOMEPATH%\gOEYMkgs\oAYi.exe
%HOMEPATH%\gOEYMkgs\BQwQ.exe
%HOMEPATH%\gOEYMkgs\ekEY.exe
%HOMEPATH%\gOEYMkgs\uccW.exe
%HOMEPATH%\gOEYMkgs\EIoc.exe
%HOMEPATH%\gOEYMkgs\Wocc.exe
%HOMEPATH%\gOEYMkgs\qgYa.exe
%HOMEPATH%\gOEYMkgs\sYwk.exe
%HOMEPATH%\gOEYMkgs\nEIM.exe
%HOMEPATH%\gOEYMkgs\nwIc.exe
%HOMEPATH%\gOEYMkgs\rcEY.exe
%HOMEPATH%\gOEYMkgs\rQMw.exe
%HOMEPATH%\gOEYMkgs\DcAI.exe
%HOMEPATH%\gOEYMkgs\iEcI.exe
%HOMEPATH%\gOEYMkgs\SoAy.exe
%HOMEPATH%\gOEYMkgs\SYsw.exe
%HOMEPATH%\gOEYMkgs\vMoE.exe
%HOMEPATH%\gOEYMkgs\gIcW.exe
%HOMEPATH%\gOEYMkgs\DogC.exe
%HOMEPATH%\gOEYMkgs\HUwq.exe
%HOMEPATH%\gOEYMkgs\hUYS.exe
%HOMEPATH%\gOEYMkgs\WwIc.exe
%HOMEPATH%\gOEYMkgs\BgsA.exe
%HOMEPATH%\gOEYMkgs\LowY.exe
%HOMEPATH%\gOEYMkgs\Ukcc.exe
%TEMP%\nwYwgswQ.bat
%HOMEPATH%\gOEYMkgs\nosa.exe
%HOMEPATH%\gOEYMkgs\XsMa.exe
%HOMEPATH%\gOEYMkgs\ngkI.exe
%HOMEPATH%\gOEYMkgs\vYIe.exe
%HOMEPATH%\gOEYMkgs\sUwo.exe
%HOMEPATH%\gOEYMkgs\UUwU.exe
%HOMEPATH%\gOEYMkgs\LAEs.exe
%HOMEPATH%\gOEYMkgs\LMgo.exe
%HOMEPATH%\gOEYMkgs\JIkI.exe
%HOMEPATH%\gOEYMkgs\JIYE.exe
%HOMEPATH%\gOEYMkgs\zUAy.exe
%HOMEPATH%\gOEYMkgs\EUgm.exe
%HOMEPATH%\gOEYMkgs\bAMU.exe
%HOMEPATH%\gOEYMkgs\KQgk.exe
%HOMEPATH%\gOEYMkgs\Dgce.exe
%HOMEPATH%\gOEYMkgs\DYMY.exe
%HOMEPATH%\gOEYMkgs\sAou.exe
%HOMEPATH%\gOEYMkgs\ewoa.exe
%HOMEPATH%\gOEYMkgs\SYoE.exe
%HOMEPATH%\gOEYMkgs\pAIy.exe
%HOMEPATH%\gOEYMkgs\WYAS.exe
%HOMEPATH%\gOEYMkgs\IwkO.exe
%HOMEPATH%\gOEYMkgs\SoMo.exe
%HOMEPATH%\gOEYMkgs\tEYI.exe
%HOMEPATH%\gOEYMkgs\DgUI.exe
%HOMEPATH%\gOEYMkgs\BUcq.exe
%HOMEPATH%\gOEYMkgs\iYEU.exe
%HOMEPATH%\gOEYMkgs\dkUi.exe
%HOMEPATH%\gOEYMkgs\rwEu.exe
%HOMEPATH%\gOEYMkgs\mQQS.exe
%HOMEPATH%\gOEYMkgs\ugYk.exe
%HOMEPATH%\gOEYMkgs\MAoY.exe
%HOMEPATH%\gOEYMkgs\vAMs.exe
%HOMEPATH%\gOEYMkgs\esEy.exe
%HOMEPATH%\gOEYMkgs\qsEy.exe
%HOMEPATH%\gOEYMkgs\OIog.exe
%HOMEPATH%\gOEYMkgs\nAIy.exe
%HOMEPATH%\gOEYMkgs\gsEc.exe
%HOMEPATH%\gOEYMkgs\MIQo.exe
%HOMEPATH%\gOEYMkgs\xEMO.exe
%HOMEPATH%\gOEYMkgs\xwoc.exe
%HOMEPATH%\gOEYMkgs\UAcu.exe
%HOMEPATH%\gOEYMkgs\Icwe.exe
%HOMEPATH%\gOEYMkgs\NYsA.exe
%HOMEPATH%\gOEYMkgs\pQYO.exe
%HOMEPATH%\gOEYMkgs\voUE.exe
%HOMEPATH%\gOEYMkgs\xYIg.exe
%HOMEPATH%\gOEYMkgs\ksMG.exe
%HOMEPATH%\gOEYMkgs\xwII.exe
%HOMEPATH%\gOEYMkgs\JwcA.exe
%HOMEPATH%\gOEYMkgs\TQkC.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'74.##5.232.51':80

TCP:

Запросы HTTP GET:

http://google.com/ via 74.##5.232.51
http:/// via 74.##5.232.51

UDP:

DNS ASK google.com

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'SSIkQYgQ.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней