Trojan.MulDrop7.35911

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Заражает следующие исполняемые файлы:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Запускает на исполнение:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\gOEYMkgs\zsYC.exe
%HOMEPATH%\gOEYMkgs\gsIA.exe
%HOMEPATH%\gOEYMkgs\YMUA.exe
%HOMEPATH%\gOEYMkgs\lgIY.exe
%HOMEPATH%\gOEYMkgs\oIUA.exe
%HOMEPATH%\gOEYMkgs\powK.exe
%HOMEPATH%\gOEYMkgs\tcUU.exe
%HOMEPATH%\gOEYMkgs\WYgQ.exe
%HOMEPATH%\gOEYMkgs\rQok.exe
%HOMEPATH%\gOEYMkgs\DoQA.exe
%HOMEPATH%\gOEYMkgs\PYca.exe
%HOMEPATH%\gOEYMkgs\cgIU.exe
%HOMEPATH%\gOEYMkgs\hoAk.exe
%HOMEPATH%\gOEYMkgs\KQUS.exe
%HOMEPATH%\gOEYMkgs\IIQi.exe
%HOMEPATH%\gOEYMkgs\zMQO.exe
%HOMEPATH%\gOEYMkgs\xwIE.exe
%HOMEPATH%\gOEYMkgs\VQYw.exe
%HOMEPATH%\gOEYMkgs\CYYK.exe
%HOMEPATH%\gOEYMkgs\oAcM.exe
%HOMEPATH%\gOEYMkgs\LsgI.exe
%HOMEPATH%\gOEYMkgs\FsIU.exe
%HOMEPATH%\gOEYMkgs\pMwS.exe
%HOMEPATH%\gOEYMkgs\GUkC.exe
%HOMEPATH%\gOEYMkgs\GsoS.exe
%HOMEPATH%\gOEYMkgs\hEME.exe
%TEMP%\WER789c.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\rQwY.exe
%HOMEPATH%\gOEYMkgs\dQYI.exe
%HOMEPATH%\gOEYMkgs\uAwq.exe
%HOMEPATH%\gOEYMkgs\VkAI.exe
%HOMEPATH%\gOEYMkgs\dYkO.exe
%HOMEPATH%\gOEYMkgs\kwsE.exe
%HOMEPATH%\gOEYMkgs\JccM.exe
%HOMEPATH%\gOEYMkgs\iUky.exe
%HOMEPATH%\gOEYMkgs\LIow.exe
%HOMEPATH%\gOEYMkgs\DEAu.exe
%HOMEPATH%\gOEYMkgs\ygIG.exe
%HOMEPATH%\gOEYMkgs\qgEE.exe
%HOMEPATH%\gOEYMkgs\Gwck.exe
%HOMEPATH%\gOEYMkgs\xoIy.exe
%HOMEPATH%\gOEYMkgs\roUO.exe
%HOMEPATH%\gOEYMkgs\vEwK.exe
%HOMEPATH%\gOEYMkgs\LMEs.exe
%HOMEPATH%\gOEYMkgs\tEQe.exe
%HOMEPATH%\gOEYMkgs\vQIA.exe
%TEMP%\WER789c.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\PIsu.exe
%TEMP%\WER789c.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\TcMQ.exe
%TEMP%\WER789c.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\DcgQ.exe
%HOMEPATH%\gOEYMkgs\HYAG.exe
%HOMEPATH%\gOEYMkgs\DIcu.exe
%HOMEPATH%\gOEYMkgs\HwEy.exe
%HOMEPATH%\gOEYMkgs\loQc.exe
%HOMEPATH%\gOEYMkgs\NsMs.exe
%HOMEPATH%\gOEYMkgs\zcUM.exe
%HOMEPATH%\gOEYMkgs\Soos.exe
%HOMEPATH%\gOEYMkgs\bgsu.exe
%HOMEPATH%\gOEYMkgs\esMA.exe
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
%HOMEPATH%\gOEYMkgs\LMEM.exe
%HOMEPATH%\gOEYMkgs\qUEE.exe
%HOMEPATH%\gOEYMkgs\RMYM.exe
%HOMEPATH%\gOEYMkgs\eQUO.exe
%HOMEPATH%\gOEYMkgs\wogs.exe
%HOMEPATH%\gOEYMkgs\ZAIY.exe
%HOMEPATH%\gOEYMkgs\GAMg.exe
%HOMEPATH%\gOEYMkgs\IAUW.exe
%HOMEPATH%\gOEYMkgs\ywcy.exe
%HOMEPATH%\gOEYMkgs\agEe.exe
%HOMEPATH%\gOEYMkgs\qIQK.exe
%HOMEPATH%\gOEYMkgs\zMwm.exe
%HOMEPATH%\gOEYMkgs\JsUw.exe
%HOMEPATH%\gOEYMkgs\yUUu.exe
%HOMEPATH%\gOEYMkgs\gsga.exe
%HOMEPATH%\gOEYMkgs\ysgK.exe
%HOMEPATH%\gOEYMkgs\pYQU.exe
%HOMEPATH%\gOEYMkgs\bwYG.exe
%HOMEPATH%\gOEYMkgs\eQEU.exe
%HOMEPATH%\gOEYMkgs\Mksc.exe
%HOMEPATH%\gOEYMkgs\lwco.exe
%HOMEPATH%\gOEYMkgs\TAgc.exe
%HOMEPATH%\gOEYMkgs\GIgA.exe
%HOMEPATH%\gOEYMkgs\oAQU.exe
%HOMEPATH%\gOEYMkgs\aUMk.exe
%HOMEPATH%\gOEYMkgs\uUYW.exe
%HOMEPATH%\gOEYMkgs\psIC.exe
%HOMEPATH%\gOEYMkgs\AIEI.exe
%HOMEPATH%\gOEYMkgs\CEQE.exe
%HOMEPATH%\gOEYMkgs\iIIA.exe
%HOMEPATH%\gOEYMkgs\lYUC.exe
%HOMEPATH%\gOEYMkgs\BAkI.exe
%HOMEPATH%\gOEYMkgs\WwEm.exe
%HOMEPATH%\gOEYMkgs\xkss.exe
%HOMEPATH%\gOEYMkgs\RAwY.exe
%HOMEPATH%\gOEYMkgs\DYAC.exe
%HOMEPATH%\gOEYMkgs\MkMu.exe
%HOMEPATH%\gOEYMkgs\VMEE.exe
%HOMEPATH%\gOEYMkgs\ygQQ.exe
%HOMEPATH%\gOEYMkgs\TYEg.exe
%HOMEPATH%\gOEYMkgs\awIs.exe
%HOMEPATH%\gOEYMkgs\GgUI.exe
%HOMEPATH%\gOEYMkgs\PUws.exe
%HOMEPATH%\gOEYMkgs\PcAy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\lwsS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\DcMY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%TEMP%\WER188f.dir00\manifest.txt
%TEMP%\WER188f.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\Gsgc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%HOMEPATH%\gOEYMkgs\hcwE.exe
%TEMP%\WER965e.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\BUoa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%TEMP%\WER965e.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\SEYs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\ywUs.exe
%HOMEPATH%\gOEYMkgs\bkEE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\FkwO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\XwYE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%ALLUSERSPROFILE%\caQc.txt
%TEMP%\WERa0c2.dir00\manifest.txt
%TEMP%\WERa0c2.dir00\appcompat.txt
<Текущая директория>\<Имя файла>
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\FkAw.exe
%TEMP%\WERa0c2.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%TEMP%\WERa0c2.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%TEMP%\WER188f.dir00\ZgMYMIIE.exe.hdmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\Ckwq.exe
%HOMEPATH%\gOEYMkgs\ZwsG.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\CIAs.exe
%TEMP%\WER188f.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\ucYk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\eUgK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\TMAM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\HoUk.exe
%TEMP%\WER02f4.dir00\manifest.txt
%TEMP%\WER02f4.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\pMoo.exe
%HOMEPATH%\gOEYMkgs\dEoQ.exe
%HOMEPATH%\gOEYMkgs\pgoa.exe
%HOMEPATH%\gOEYMkgs\VAsW.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\PwAI.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%TEMP%\WER02f4.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\lsgw.exe
%TEMP%\WER02f4.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\NcMQ.exe
%HOMEPATH%\gOEYMkgs\jEIC.exe
%HOMEPATH%\gOEYMkgs\KIoq.exe
%HOMEPATH%\gOEYMkgs\MMgs.exe
%HOMEPATH%\gOEYMkgs\qssU.exe
%HOMEPATH%\gOEYMkgs\yIsA.exe
%HOMEPATH%\gOEYMkgs\tMgO.exe
%HOMEPATH%\gOEYMkgs\eooE.exe
%HOMEPATH%\gOEYMkgs\oYYU.exe
%HOMEPATH%\gOEYMkgs\CgYI.exe
%HOMEPATH%\gOEYMkgs\BQMI.exe
%HOMEPATH%\gOEYMkgs\yosa.exe
%HOMEPATH%\gOEYMkgs\tsQM.exe
%HOMEPATH%\gOEYMkgs\bgQC.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\MIke.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\RUIC.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\HAwM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%TEMP%\WER965e.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\UoUC.exe
%TEMP%\WER965e.dir00\appcompat.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\UYAe.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\yMos.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%HOMEPATH%\gOEYMkgs\gcoO.exe
%HOMEPATH%\gOEYMkgs\XsEY.exe
%HOMEPATH%\gOEYMkgs\pMEM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\KcwI.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\TYsM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe

Удаляет следующие файлы:

%HOMEPATH%\gOEYMkgs\aUMk.exe
%HOMEPATH%\gOEYMkgs\uUYW.exe
%HOMEPATH%\gOEYMkgs\CEQE.exe
%HOMEPATH%\gOEYMkgs\oAQU.exe
%HOMEPATH%\gOEYMkgs\xwIE.exe
%HOMEPATH%\gOEYMkgs\KQUS.exe
%HOMEPATH%\gOEYMkgs\IIQi.exe
%HOMEPATH%\gOEYMkgs\VQYw.exe
%HOMEPATH%\gOEYMkgs\CYYK.exe
%HOMEPATH%\gOEYMkgs\TAgc.exe
%HOMEPATH%\gOEYMkgs\pYQU.exe
%HOMEPATH%\gOEYMkgs\Mksc.exe
%HOMEPATH%\gOEYMkgs\lwco.exe
%HOMEPATH%\gOEYMkgs\bwYG.exe
%HOMEPATH%\gOEYMkgs\psIC.exe
%HOMEPATH%\gOEYMkgs\AIEI.exe
%HOMEPATH%\gOEYMkgs\eQEU.exe
%HOMEPATH%\gOEYMkgs\GIgA.exe
%HOMEPATH%\gOEYMkgs\zMQO.exe
%HOMEPATH%\gOEYMkgs\gsIA.exe
%HOMEPATH%\gOEYMkgs\YMUA.exe
%HOMEPATH%\gOEYMkgs\powK.exe
%HOMEPATH%\gOEYMkgs\zsYC.exe
%HOMEPATH%\gOEYMkgs\tcUU.exe
%HOMEPATH%\gOEYMkgs\hoAk.exe
%HOMEPATH%\gOEYMkgs\WYgQ.exe
%HOMEPATH%\gOEYMkgs\PYca.exe
%HOMEPATH%\gOEYMkgs\cgIU.exe
%HOMEPATH%\gOEYMkgs\GsoS.exe
%HOMEPATH%\gOEYMkgs\hEME.exe
%HOMEPATH%\gOEYMkgs\oAcM.exe
%HOMEPATH%\gOEYMkgs\GUkC.exe
%HOMEPATH%\gOEYMkgs\LsgI.exe
%HOMEPATH%\gOEYMkgs\lgIY.exe
%HOMEPATH%\gOEYMkgs\oIUA.exe
%HOMEPATH%\gOEYMkgs\FsIU.exe
%HOMEPATH%\gOEYMkgs\pMwS.exe
%HOMEPATH%\gOEYMkgs\ygQQ.exe
%HOMEPATH%\gOEYMkgs\zMwm.exe
%HOMEPATH%\gOEYMkgs\JsUw.exe
%HOMEPATH%\gOEYMkgs\ysgK.exe
%HOMEPATH%\gOEYMkgs\qIQK.exe
%HOMEPATH%\gOEYMkgs\loQc.exe
%HOMEPATH%\gOEYMkgs\HYAG.exe
%HOMEPATH%\gOEYMkgs\DIcu.exe
%HOMEPATH%\gOEYMkgs\NsMs.exe
%HOMEPATH%\gOEYMkgs\zcUM.exe
%HOMEPATH%\gOEYMkgs\ywcy.exe
%HOMEPATH%\gOEYMkgs\eQUO.exe
%HOMEPATH%\gOEYMkgs\GAMg.exe
%HOMEPATH%\gOEYMkgs\IAUW.exe
%HOMEPATH%\gOEYMkgs\wogs.exe
%HOMEPATH%\gOEYMkgs\yUUu.exe
%HOMEPATH%\gOEYMkgs\gsga.exe
%HOMEPATH%\gOEYMkgs\ZAIY.exe
%HOMEPATH%\gOEYMkgs\agEe.exe
%HOMEPATH%\gOEYMkgs\HwEy.exe
%HOMEPATH%\gOEYMkgs\BAkI.exe
%HOMEPATH%\gOEYMkgs\DYAC.exe
%HOMEPATH%\gOEYMkgs\iIIA.exe
%HOMEPATH%\gOEYMkgs\lYUC.exe
%HOMEPATH%\gOEYMkgs\TYEg.exe
%HOMEPATH%\gOEYMkgs\MkMu.exe
%HOMEPATH%\gOEYMkgs\VMEE.exe
%HOMEPATH%\gOEYMkgs\awIs.exe
%HOMEPATH%\gOEYMkgs\GgUI.exe
%HOMEPATH%\gOEYMkgs\qUEE.exe
%HOMEPATH%\gOEYMkgs\RMYM.exe
%HOMEPATH%\gOEYMkgs\Soos.exe
%HOMEPATH%\gOEYMkgs\LMEM.exe
%HOMEPATH%\gOEYMkgs\bgsu.exe
%HOMEPATH%\gOEYMkgs\xkss.exe
%HOMEPATH%\gOEYMkgs\RAwY.exe
%HOMEPATH%\gOEYMkgs\esMA.exe
%HOMEPATH%\gOEYMkgs\WwEm.exe
%HOMEPATH%\gOEYMkgs\rQok.exe
%HOMEPATH%\gOEYMkgs\pMEM.exe
%HOMEPATH%\gOEYMkgs\KcwI.exe
%HOMEPATH%\gOEYMkgs\XsEY.exe
%HOMEPATH%\gOEYMkgs\TYsM.exe
%HOMEPATH%\gOEYMkgs\RUIC.exe
%HOMEPATH%\gOEYMkgs\UoUC.exe
%HOMEPATH%\gOEYMkgs\HAwM.exe
%HOMEPATH%\gOEYMkgs\bgQC.exe
%HOMEPATH%\gOEYMkgs\MIke.exe
%HOMEPATH%\gOEYMkgs\HoUk.exe
%HOMEPATH%\gOEYMkgs\VAsW.exe
%HOMEPATH%\gOEYMkgs\dEoQ.exe
%HOMEPATH%\gOEYMkgs\pgoa.exe
%HOMEPATH%\gOEYMkgs\lsgw.exe
%HOMEPATH%\gOEYMkgs\gcoO.exe
%HOMEPATH%\gOEYMkgs\UYAe.exe
%HOMEPATH%\gOEYMkgs\PwAI.exe
%HOMEPATH%\gOEYMkgs\yMos.exe
%HOMEPATH%\gOEYMkgs\SEYs.exe
%HOMEPATH%\gOEYMkgs\CIAs.exe
%HOMEPATH%\gOEYMkgs\Ckwq.exe
%HOMEPATH%\gOEYMkgs\hcwE.exe
%HOMEPATH%\gOEYMkgs\ZwsG.exe
%HOMEPATH%\gOEYMkgs\TMAM.exe
%TEMP%\kUYMQkEA.bat
%HOMEPATH%\gOEYMkgs\FkAw.exe
%HOMEPATH%\gOEYMkgs\ucYk.exe
%HOMEPATH%\gOEYMkgs\eUgK.exe
%HOMEPATH%\gOEYMkgs\XwYE.exe
%HOMEPATH%\gOEYMkgs\bkEE.exe
%HOMEPATH%\gOEYMkgs\BUoa.exe
%HOMEPATH%\gOEYMkgs\ywUs.exe
%HOMEPATH%\gOEYMkgs\FkwO.exe
%HOMEPATH%\gOEYMkgs\lwsS.exe
%HOMEPATH%\gOEYMkgs\Gsgc.exe
%HOMEPATH%\gOEYMkgs\DcMY.exe
%HOMEPATH%\gOEYMkgs\PcAy.exe
%HOMEPATH%\gOEYMkgs\pMoo.exe
%HOMEPATH%\gOEYMkgs\uAwq.exe
%HOMEPATH%\gOEYMkgs\VkAI.exe
%HOMEPATH%\gOEYMkgs\DcgQ.exe
%HOMEPATH%\gOEYMkgs\PIsu.exe
%HOMEPATH%\gOEYMkgs\dYkO.exe
%HOMEPATH%\gOEYMkgs\kwsE.exe
%HOMEPATH%\gOEYMkgs\DEAu.exe
%HOMEPATH%\gOEYMkgs\rQwY.exe
%HOMEPATH%\gOEYMkgs\dQYI.exe
%HOMEPATH%\gOEYMkgs\LMEs.exe
%HOMEPATH%\gOEYMkgs\tEQe.exe
%HOMEPATH%\gOEYMkgs\DoQA.exe
%HOMEPATH%\gOEYMkgs\vEwK.exe
%HOMEPATH%\gOEYMkgs\Gwck.exe
%HOMEPATH%\gOEYMkgs\vQIA.exe
%HOMEPATH%\gOEYMkgs\TcMQ.exe
%HOMEPATH%\gOEYMkgs\xoIy.exe
%HOMEPATH%\gOEYMkgs\roUO.exe
%HOMEPATH%\gOEYMkgs\ygIG.exe
%HOMEPATH%\gOEYMkgs\tMgO.exe
%HOMEPATH%\gOEYMkgs\BQMI.exe
%HOMEPATH%\gOEYMkgs\jEIC.exe
%HOMEPATH%\gOEYMkgs\KIoq.exe
%HOMEPATH%\gOEYMkgs\yosa.exe
%HOMEPATH%\gOEYMkgs\oYYU.exe
%HOMEPATH%\gOEYMkgs\CgYI.exe
%HOMEPATH%\gOEYMkgs\tsQM.exe
%HOMEPATH%\gOEYMkgs\eooE.exe
%HOMEPATH%\gOEYMkgs\iUky.exe
%HOMEPATH%\gOEYMkgs\LIow.exe
%HOMEPATH%\gOEYMkgs\qgEE.exe
%HOMEPATH%\gOEYMkgs\JccM.exe
%HOMEPATH%\gOEYMkgs\PUws.exe
%HOMEPATH%\gOEYMkgs\yIsA.exe
%HOMEPATH%\gOEYMkgs\NcMQ.exe
%HOMEPATH%\gOEYMkgs\MMgs.exe
%HOMEPATH%\gOEYMkgs\qssU.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'74.##5.232.51':80

TCP:

Запросы HTTP GET:

http://google.com/ via 74.##5.232.51
http:/// via 74.##5.232.51

UDP:

DNS ASK google.com

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'lacMcYws.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней