Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
- <STUBS_DIR>\test.exe
- C:\Far2\Far.exe
- скрытых файлов
- расширений файлов
- Средство контроля пользовательских учетных записей (UAC)
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- <SYSTEM32>\cmd.exe
- %HOMEPATH%\gOEYMkgs\pgsk.exe
- %HOMEPATH%\gOEYMkgs\PoQy.exe
- %TEMP%\WERbb92.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\Koky.exe
- %TEMP%\WERbb92.dir00\manifest.txt
- %TEMP%\WERbb92.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\dIoK.exe
- %HOMEPATH%\gOEYMkgs\UYMA.exe
- %HOMEPATH%\gOEYMkgs\owwK.exe
- %HOMEPATH%\gOEYMkgs\hAYy.exe
- %TEMP%\WERbb92.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\nkYa.exe
- %HOMEPATH%\gOEYMkgs\qcoM.exe
- %HOMEPATH%\gOEYMkgs\aMEY.exe
- %HOMEPATH%\gOEYMkgs\UMwM.exe
- %HOMEPATH%\gOEYMkgs\NIMO.exe
- %HOMEPATH%\gOEYMkgs\NUQE.exe
- %HOMEPATH%\gOEYMkgs\SoEm.exe
- %HOMEPATH%\gOEYMkgs\AgQM.exe
- %HOMEPATH%\gOEYMkgs\JQEs.exe
- %HOMEPATH%\gOEYMkgs\fkog.exe
- %HOMEPATH%\gOEYMkgs\BoIe.exe
- %HOMEPATH%\gOEYMkgs\qsEQ.exe
- %HOMEPATH%\gOEYMkgs\LEUG.exe
- %HOMEPATH%\gOEYMkgs\fwYY.exe
- %HOMEPATH%\gOEYMkgs\FMUi.exe
- %HOMEPATH%\gOEYMkgs\RIMO.exe
- %HOMEPATH%\gOEYMkgs\zAkY.exe
- %TEMP%\WER4a0b.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\tkYo.exe
- %HOMEPATH%\gOEYMkgs\JQwC.exe
- %HOMEPATH%\gOEYMkgs\HQUA.exe
- %HOMEPATH%\gOEYMkgs\gMok.exe
- %HOMEPATH%\gOEYMkgs\vMMq.exe
- %HOMEPATH%\gOEYMkgs\BksA.exe
- %HOMEPATH%\gOEYMkgs\XIYg.exe
- %TEMP%\WER4a0b.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\Rgke.exe
- %HOMEPATH%\gOEYMkgs\VwIu.exe
- %HOMEPATH%\gOEYMkgs\pQcC.exe
- %HOMEPATH%\gOEYMkgs\ygou.exe
- %HOMEPATH%\gOEYMkgs\gUIu.exe
- %HOMEPATH%\gOEYMkgs\LMUM.exe
- %HOMEPATH%\gOEYMkgs\pkoY.exe
- %HOMEPATH%\gOEYMkgs\rggC.exe
- %HOMEPATH%\gOEYMkgs\zsYK.exe
- %HOMEPATH%\gOEYMkgs\HMIK.exe
- %HOMEPATH%\gOEYMkgs\wMEu.exe
- %HOMEPATH%\gOEYMkgs\BQwa.exe
- %HOMEPATH%\gOEYMkgs\TgIA.exe
- %HOMEPATH%\gOEYMkgs\PAwg.exe
- %HOMEPATH%\gOEYMkgs\wocM.exe
- %HOMEPATH%\gOEYMkgs\hEQs.exe
- %HOMEPATH%\gOEYMkgs\HIAA.exe
- %HOMEPATH%\gOEYMkgs\SosA.exe
- %HOMEPATH%\gOEYMkgs\FAsK.exe
- %HOMEPATH%\gOEYMkgs\egse.exe
- %HOMEPATH%\gOEYMkgs\rUcY.exe
- %HOMEPATH%\gOEYMkgs\rcgK.exe
- %HOMEPATH%\gOEYMkgs\vYMw.exe
- %HOMEPATH%\gOEYMkgs\PYIs.exe
- %HOMEPATH%\gOEYMkgs\swIU.exe
- %HOMEPATH%\gOEYMkgs\YoYm.exe
- %HOMEPATH%\gOEYMkgs\xwok.exe
- %TEMP%\WER31d7.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER31d7.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\wgwS.exe
- C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
- %TEMP%\WER31d7.dir00\manifest.txt
- %TEMP%\WER31d7.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\BIce.exe
- %HOMEPATH%\gOEYMkgs\PIYI.exe
- %HOMEPATH%\gOEYMkgs\CUsA.exe
- %HOMEPATH%\gOEYMkgs\jcAQ.exe
- %HOMEPATH%\gOEYMkgs\ZoYa.exe
- %HOMEPATH%\gOEYMkgs\dcoO.exe
- %HOMEPATH%\gOEYMkgs\kwEM.exe
- %HOMEPATH%\gOEYMkgs\Ewgw.exe
- %HOMEPATH%\gOEYMkgs\pEoK.exe
- %HOMEPATH%\gOEYMkgs\UsMm.exe
- %HOMEPATH%\gOEYMkgs\ucss.exe
- %HOMEPATH%\gOEYMkgs\PgQy.exe
- %HOMEPATH%\gOEYMkgs\qcwS.exe
- %HOMEPATH%\gOEYMkgs\igIy.exe
- %HOMEPATH%\gOEYMkgs\BQMw.exe
- %HOMEPATH%\gOEYMkgs\TAMs.exe
- %HOMEPATH%\gOEYMkgs\mogM.exe
- %HOMEPATH%\gOEYMkgs\SgEu.exe
- %HOMEPATH%\gOEYMkgs\IMYu.exe
- %HOMEPATH%\gOEYMkgs\gskY.exe
- %HOMEPATH%\gOEYMkgs\GQUw.exe
- %HOMEPATH%\gOEYMkgs\xIsQ.exe
- %HOMEPATH%\gOEYMkgs\pIcq.exe
- %HOMEPATH%\gOEYMkgs\zEEo.exe
- %HOMEPATH%\gOEYMkgs\tQck.exe
- %HOMEPATH%\gOEYMkgs\YcYe.exe
- %HOMEPATH%\gOEYMkgs\dkom.exe
- %HOMEPATH%\gOEYMkgs\hUsq.exe
- %HOMEPATH%\gOEYMkgs\nksy.exe
- %HOMEPATH%\gOEYMkgs\Xwco.exe
- %HOMEPATH%\gOEYMkgs\McwG.exe
- %HOMEPATH%\gOEYMkgs\cocw.exe
- %HOMEPATH%\gOEYMkgs\FYEI.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %HOMEPATH%\gOEYMkgs\PAom.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %HOMEPATH%\gOEYMkgs\ZQci.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %HOMEPATH%\gOEYMkgs\sUEO.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %HOMEPATH%\gOEYMkgs\KEYA.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %HOMEPATH%\gOEYMkgs\dkEq.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %HOMEPATH%\gOEYMkgs\HooC.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %HOMEPATH%\gOEYMkgs\iwEk.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %HOMEPATH%\gOEYMkgs\kIMs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\sIIA.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %HOMEPATH%\gOEYMkgs\IUYU.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %HOMEPATH%\gOEYMkgs\Isww.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %HOMEPATH%\gOEYMkgs\WYAE.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %TEMP%\WERd0f8.dir00\appcompat.txt
- %TEMP%\WERd0f8.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WERd0f8.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %HOMEPATH%\gOEYMkgs\gkwm.exe
- %TEMP%\WERd0f8.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %ALLUSERSPROFILE%\caQc.txt
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %HOMEPATH%\gOEYMkgs\Egwa.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %HOMEPATH%\gOEYMkgs\kEMQ.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %HOMEPATH%\gOEYMkgs\MAoc.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %HOMEPATH%\gOEYMkgs\HMAM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %HOMEPATH%\gOEYMkgs\BQgc.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %HOMEPATH%\gOEYMkgs\QIck.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %HOMEPATH%\gOEYMkgs\qwoO.exe
- %HOMEPATH%\gOEYMkgs\Xkss.exe
- %HOMEPATH%\gOEYMkgs\Noku.exe
- %HOMEPATH%\gOEYMkgs\TYIy.exe
- %HOMEPATH%\gOEYMkgs\mkQe.exe
- %HOMEPATH%\gOEYMkgs\nEUo.exe
- %HOMEPATH%\gOEYMkgs\mYwI.exe
- %HOMEPATH%\gOEYMkgs\KAcU.exe
- %HOMEPATH%\gOEYMkgs\cUQc.exe
- <Текущая директория>\<Имя файла>
- %HOMEPATH%\gOEYMkgs\HwcS.exe
- %TEMP%\WER4a0b.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\ssYE.exe
- %HOMEPATH%\gOEYMkgs\eEcw.exe
- %HOMEPATH%\gOEYMkgs\dwww.exe
- %TEMP%\WER4a0b.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\gUoE.exe
- %HOMEPATH%\gOEYMkgs\xgUK.exe
- %HOMEPATH%\gOEYMkgs\LIse.exe
- %HOMEPATH%\gOEYMkgs\pAgk.exe
- %HOMEPATH%\gOEYMkgs\ckUS.exe
- %HOMEPATH%\gOEYMkgs\DMUy.exe
- %HOMEPATH%\gOEYMkgs\kkIE.exe
- %HOMEPATH%\gOEYMkgs\nkIg.exe
- %HOMEPATH%\gOEYMkgs\JAMi.exe
- %HOMEPATH%\gOEYMkgs\NgsW.exe
- %HOMEPATH%\gOEYMkgs\CcwK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %HOMEPATH%\gOEYMkgs\mcsM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\WYUo.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %HOMEPATH%\gOEYMkgs\icMs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %HOMEPATH%\gOEYMkgs\Essk.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\Hggk.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %HOMEPATH%\gOEYMkgs\Swwy.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %HOMEPATH%\gOEYMkgs\rwUg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %HOMEPATH%\gOEYMkgs\xUES.exe
- %HOMEPATH%\gOEYMkgs\UMsi.exe
- %HOMEPATH%\gOEYMkgs\hEcm.exe
- %HOMEPATH%\gOEYMkgs\DAse.exe
- %HOMEPATH%\gOEYMkgs\cQAw.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %HOMEPATH%\gOEYMkgs\fMEQ.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %HOMEPATH%\gOEYMkgs\BMMU.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %HOMEPATH%\gOEYMkgs\aMEY.exe
- %HOMEPATH%\gOEYMkgs\UMwM.exe
- %HOMEPATH%\gOEYMkgs\SoEm.exe
- %HOMEPATH%\gOEYMkgs\AgQM.exe
- %HOMEPATH%\gOEYMkgs\NIMO.exe
- %HOMEPATH%\gOEYMkgs\fwYY.exe
- %HOMEPATH%\gOEYMkgs\JQEs.exe
- %HOMEPATH%\gOEYMkgs\qsEQ.exe
- %HOMEPATH%\gOEYMkgs\LEUG.exe
- %HOMEPATH%\gOEYMkgs\mogM.exe
- %HOMEPATH%\gOEYMkgs\SgEu.exe
- %HOMEPATH%\gOEYMkgs\pEoK.exe
- %HOMEPATH%\gOEYMkgs\UsMm.exe
- %HOMEPATH%\gOEYMkgs\IMYu.exe
- %HOMEPATH%\gOEYMkgs\TAMs.exe
- %HOMEPATH%\gOEYMkgs\NUQE.exe
- %HOMEPATH%\gOEYMkgs\igIy.exe
- %HOMEPATH%\gOEYMkgs\BQMw.exe
- %HOMEPATH%\gOEYMkgs\fkog.exe
- %HOMEPATH%\gOEYMkgs\LMUM.exe
- %HOMEPATH%\gOEYMkgs\pkoY.exe
- %HOMEPATH%\gOEYMkgs\owwK.exe
- %HOMEPATH%\gOEYMkgs\FMUi.exe
- %HOMEPATH%\gOEYMkgs\rggC.exe
- %HOMEPATH%\gOEYMkgs\gUIu.exe
- %HOMEPATH%\gOEYMkgs\BQwa.exe
- %HOMEPATH%\gOEYMkgs\pQcC.exe
- %HOMEPATH%\gOEYMkgs\ygou.exe
- %HOMEPATH%\gOEYMkgs\Koky.exe
- %HOMEPATH%\gOEYMkgs\pgsk.exe
- %HOMEPATH%\gOEYMkgs\BoIe.exe
- %HOMEPATH%\gOEYMkgs\qcoM.exe
- %HOMEPATH%\gOEYMkgs\PoQy.exe
- %HOMEPATH%\gOEYMkgs\dIoK.exe
- %HOMEPATH%\gOEYMkgs\UYMA.exe
- %HOMEPATH%\gOEYMkgs\hAYy.exe
- %HOMEPATH%\gOEYMkgs\nkYa.exe
- %HOMEPATH%\gOEYMkgs\Ewgw.exe
- %HOMEPATH%\gOEYMkgs\wocM.exe
- %HOMEPATH%\gOEYMkgs\hEQs.exe
- %HOMEPATH%\gOEYMkgs\FAsK.exe
- %HOMEPATH%\gOEYMkgs\egse.exe
- %HOMEPATH%\gOEYMkgs\HIAA.exe
- %HOMEPATH%\gOEYMkgs\YoYm.exe
- %HOMEPATH%\gOEYMkgs\rUcY.exe
- %HOMEPATH%\gOEYMkgs\PYIs.exe
- %HOMEPATH%\gOEYMkgs\swIU.exe
- %HOMEPATH%\gOEYMkgs\ZoYa.exe
- %HOMEPATH%\gOEYMkgs\dcoO.exe
- %HOMEPATH%\gOEYMkgs\wgwS.exe
- %HOMEPATH%\gOEYMkgs\jcAQ.exe
- %HOMEPATH%\gOEYMkgs\BIce.exe
- %HOMEPATH%\gOEYMkgs\xwok.exe
- %HOMEPATH%\gOEYMkgs\SosA.exe
- %HOMEPATH%\gOEYMkgs\PIYI.exe
- %HOMEPATH%\gOEYMkgs\CUsA.exe
- %HOMEPATH%\gOEYMkgs\rcgK.exe
- %HOMEPATH%\gOEYMkgs\dkom.exe
- %HOMEPATH%\gOEYMkgs\hUsq.exe
- %HOMEPATH%\gOEYMkgs\McwG.exe
- %HOMEPATH%\gOEYMkgs\cocw.exe
- %HOMEPATH%\gOEYMkgs\nksy.exe
- %HOMEPATH%\gOEYMkgs\PgQy.exe
- %HOMEPATH%\gOEYMkgs\qcwS.exe
- %HOMEPATH%\gOEYMkgs\gskY.exe
- %HOMEPATH%\gOEYMkgs\ucss.exe
- %HOMEPATH%\gOEYMkgs\zEEo.exe
- %HOMEPATH%\gOEYMkgs\tQck.exe
- %HOMEPATH%\gOEYMkgs\vYMw.exe
- %HOMEPATH%\gOEYMkgs\kwEM.exe
- %HOMEPATH%\gOEYMkgs\YcYe.exe
- %HOMEPATH%\gOEYMkgs\pIcq.exe
- %HOMEPATH%\gOEYMkgs\Xwco.exe
- %HOMEPATH%\gOEYMkgs\GQUw.exe
- %HOMEPATH%\gOEYMkgs\xIsQ.exe
- %HOMEPATH%\gOEYMkgs\icMs.exe
- %HOMEPATH%\gOEYMkgs\mcsM.exe
- %HOMEPATH%\gOEYMkgs\fMEQ.exe
- %HOMEPATH%\gOEYMkgs\WYUo.exe
- %HOMEPATH%\gOEYMkgs\Hggk.exe
- %HOMEPATH%\gOEYMkgs\kIMs.exe
- %HOMEPATH%\gOEYMkgs\sIIA.exe
- %HOMEPATH%\gOEYMkgs\Swwy.exe
- %HOMEPATH%\gOEYMkgs\Essk.exe
- %HOMEPATH%\gOEYMkgs\UMsi.exe
- %HOMEPATH%\gOEYMkgs\hEcm.exe
- %TEMP%\EwYMMgEU.bat
- %HOMEPATH%\gOEYMkgs\CcwK.exe
- %HOMEPATH%\gOEYMkgs\DAse.exe
- %HOMEPATH%\gOEYMkgs\BMMU.exe
- %HOMEPATH%\gOEYMkgs\cQAw.exe
- %HOMEPATH%\gOEYMkgs\rwUg.exe
- %HOMEPATH%\gOEYMkgs\xUES.exe
- %HOMEPATH%\gOEYMkgs\iwEk.exe
- %HOMEPATH%\gOEYMkgs\HMAM.exe
- %HOMEPATH%\gOEYMkgs\kEMQ.exe
- %HOMEPATH%\gOEYMkgs\KEYA.exe
- %HOMEPATH%\gOEYMkgs\MAoc.exe
- %HOMEPATH%\gOEYMkgs\QIck.exe
- %HOMEPATH%\gOEYMkgs\Egwa.exe
- %HOMEPATH%\gOEYMkgs\gkwm.exe
- %HOMEPATH%\gOEYMkgs\qwoO.exe
- %HOMEPATH%\gOEYMkgs\BQgc.exe
- %HOMEPATH%\gOEYMkgs\IUYU.exe
- %HOMEPATH%\gOEYMkgs\HooC.exe
- %HOMEPATH%\gOEYMkgs\Isww.exe
- %HOMEPATH%\gOEYMkgs\WYAE.exe
- %HOMEPATH%\gOEYMkgs\ZQci.exe
- %HOMEPATH%\gOEYMkgs\dkEq.exe
- %HOMEPATH%\gOEYMkgs\sUEO.exe
- %HOMEPATH%\gOEYMkgs\FYEI.exe
- %HOMEPATH%\gOEYMkgs\PAom.exe
- %HOMEPATH%\gOEYMkgs\cUQc.exe
- %HOMEPATH%\gOEYMkgs\XIYg.exe
- %HOMEPATH%\gOEYMkgs\Rgke.exe
- %HOMEPATH%\gOEYMkgs\RIMO.exe
- %HOMEPATH%\gOEYMkgs\zAkY.exe
- %HOMEPATH%\gOEYMkgs\gMok.exe
- %HOMEPATH%\gOEYMkgs\xgUK.exe
- %HOMEPATH%\gOEYMkgs\LIse.exe
- %HOMEPATH%\gOEYMkgs\vMMq.exe
- %HOMEPATH%\gOEYMkgs\BksA.exe
- %HOMEPATH%\gOEYMkgs\zsYK.exe
- %HOMEPATH%\gOEYMkgs\HMIK.exe
- %HOMEPATH%\gOEYMkgs\TgIA.exe
- %HOMEPATH%\gOEYMkgs\PAwg.exe
- %HOMEPATH%\gOEYMkgs\wMEu.exe
- %HOMEPATH%\gOEYMkgs\JQwC.exe
- %HOMEPATH%\gOEYMkgs\HQUA.exe
- %HOMEPATH%\gOEYMkgs\VwIu.exe
- %HOMEPATH%\gOEYMkgs\tkYo.exe
- %HOMEPATH%\gOEYMkgs\pAgk.exe
- %HOMEPATH%\gOEYMkgs\mYwI.exe
- %HOMEPATH%\gOEYMkgs\Xkss.exe
- %HOMEPATH%\gOEYMkgs\mkQe.exe
- %HOMEPATH%\gOEYMkgs\nEUo.exe
- %HOMEPATH%\gOEYMkgs\Noku.exe
- %HOMEPATH%\gOEYMkgs\ssYE.exe
- %HOMEPATH%\gOEYMkgs\KAcU.exe
- %HOMEPATH%\gOEYMkgs\TYIy.exe
- %HOMEPATH%\gOEYMkgs\HwcS.exe
- %HOMEPATH%\gOEYMkgs\nkIg.exe
- %HOMEPATH%\gOEYMkgs\JAMi.exe
- %HOMEPATH%\gOEYMkgs\dwww.exe
- %HOMEPATH%\gOEYMkgs\gUoE.exe
- %HOMEPATH%\gOEYMkgs\NgsW.exe
- %HOMEPATH%\gOEYMkgs\kkIE.exe
- %HOMEPATH%\gOEYMkgs\eEcw.exe
- %HOMEPATH%\gOEYMkgs\ckUS.exe
- %HOMEPATH%\gOEYMkgs\DMUy.exe
- %HOMEPATH%\gOEYMkgs\cUQc.exe
- '74.##5.232.51':443
- 'ap#.###coincharts.com':443
- '74.##5.232.51':80
- http:/// via 74.##5.232.51
- http://google.com/ via 74.##5.232.51
- DNS ASK ma##.google.com
- DNS ASK ap#.###coincharts.com
- DNS ASK google.com
- ClassName: '' WindowName: 'Run'
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: 'Open'
- ClassName: 'WorkerW' WindowName: ''
- ClassName: 'DV2ControlHost' WindowName: ''
- ClassName: 'BUTTON' WindowName: 'START'
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'lacMcYws.exe'
- ClassName: '' WindowName: 'xSMgIcIg'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Windows Internet Explorer'
- ClassName: '' WindowName: 'Open File'