Trojan.MulDrop7.35926

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Заражает следующие исполняемые файлы:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Запускает на исполнение:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cmd.exe

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\gOEYMkgs\pgsk.exe
%HOMEPATH%\gOEYMkgs\PoQy.exe
%TEMP%\WERbb92.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\Koky.exe
%TEMP%\WERbb92.dir00\manifest.txt
%TEMP%\WERbb92.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\dIoK.exe
%HOMEPATH%\gOEYMkgs\UYMA.exe
%HOMEPATH%\gOEYMkgs\owwK.exe
%HOMEPATH%\gOEYMkgs\hAYy.exe
%TEMP%\WERbb92.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\nkYa.exe
%HOMEPATH%\gOEYMkgs\qcoM.exe
%HOMEPATH%\gOEYMkgs\aMEY.exe
%HOMEPATH%\gOEYMkgs\UMwM.exe
%HOMEPATH%\gOEYMkgs\NIMO.exe
%HOMEPATH%\gOEYMkgs\NUQE.exe
%HOMEPATH%\gOEYMkgs\SoEm.exe
%HOMEPATH%\gOEYMkgs\AgQM.exe
%HOMEPATH%\gOEYMkgs\JQEs.exe
%HOMEPATH%\gOEYMkgs\fkog.exe
%HOMEPATH%\gOEYMkgs\BoIe.exe
%HOMEPATH%\gOEYMkgs\qsEQ.exe
%HOMEPATH%\gOEYMkgs\LEUG.exe
%HOMEPATH%\gOEYMkgs\fwYY.exe
%HOMEPATH%\gOEYMkgs\FMUi.exe
%HOMEPATH%\gOEYMkgs\RIMO.exe
%HOMEPATH%\gOEYMkgs\zAkY.exe
%TEMP%\WER4a0b.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\tkYo.exe
%HOMEPATH%\gOEYMkgs\JQwC.exe
%HOMEPATH%\gOEYMkgs\HQUA.exe
%HOMEPATH%\gOEYMkgs\gMok.exe
%HOMEPATH%\gOEYMkgs\vMMq.exe
%HOMEPATH%\gOEYMkgs\BksA.exe
%HOMEPATH%\gOEYMkgs\XIYg.exe
%TEMP%\WER4a0b.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\Rgke.exe
%HOMEPATH%\gOEYMkgs\VwIu.exe
%HOMEPATH%\gOEYMkgs\pQcC.exe
%HOMEPATH%\gOEYMkgs\ygou.exe
%HOMEPATH%\gOEYMkgs\gUIu.exe
%HOMEPATH%\gOEYMkgs\LMUM.exe
%HOMEPATH%\gOEYMkgs\pkoY.exe
%HOMEPATH%\gOEYMkgs\rggC.exe
%HOMEPATH%\gOEYMkgs\zsYK.exe
%HOMEPATH%\gOEYMkgs\HMIK.exe
%HOMEPATH%\gOEYMkgs\wMEu.exe
%HOMEPATH%\gOEYMkgs\BQwa.exe
%HOMEPATH%\gOEYMkgs\TgIA.exe
%HOMEPATH%\gOEYMkgs\PAwg.exe
%HOMEPATH%\gOEYMkgs\wocM.exe
%HOMEPATH%\gOEYMkgs\hEQs.exe
%HOMEPATH%\gOEYMkgs\HIAA.exe
%HOMEPATH%\gOEYMkgs\SosA.exe
%HOMEPATH%\gOEYMkgs\FAsK.exe
%HOMEPATH%\gOEYMkgs\egse.exe
%HOMEPATH%\gOEYMkgs\rUcY.exe
%HOMEPATH%\gOEYMkgs\rcgK.exe
%HOMEPATH%\gOEYMkgs\vYMw.exe
%HOMEPATH%\gOEYMkgs\PYIs.exe
%HOMEPATH%\gOEYMkgs\swIU.exe
%HOMEPATH%\gOEYMkgs\YoYm.exe
%HOMEPATH%\gOEYMkgs\xwok.exe
%TEMP%\WER31d7.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER31d7.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\wgwS.exe
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
%TEMP%\WER31d7.dir00\manifest.txt
%TEMP%\WER31d7.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\BIce.exe
%HOMEPATH%\gOEYMkgs\PIYI.exe
%HOMEPATH%\gOEYMkgs\CUsA.exe
%HOMEPATH%\gOEYMkgs\jcAQ.exe
%HOMEPATH%\gOEYMkgs\ZoYa.exe
%HOMEPATH%\gOEYMkgs\dcoO.exe
%HOMEPATH%\gOEYMkgs\kwEM.exe
%HOMEPATH%\gOEYMkgs\Ewgw.exe
%HOMEPATH%\gOEYMkgs\pEoK.exe
%HOMEPATH%\gOEYMkgs\UsMm.exe
%HOMEPATH%\gOEYMkgs\ucss.exe
%HOMEPATH%\gOEYMkgs\PgQy.exe
%HOMEPATH%\gOEYMkgs\qcwS.exe
%HOMEPATH%\gOEYMkgs\igIy.exe
%HOMEPATH%\gOEYMkgs\BQMw.exe
%HOMEPATH%\gOEYMkgs\TAMs.exe
%HOMEPATH%\gOEYMkgs\mogM.exe
%HOMEPATH%\gOEYMkgs\SgEu.exe
%HOMEPATH%\gOEYMkgs\IMYu.exe
%HOMEPATH%\gOEYMkgs\gskY.exe
%HOMEPATH%\gOEYMkgs\GQUw.exe
%HOMEPATH%\gOEYMkgs\xIsQ.exe
%HOMEPATH%\gOEYMkgs\pIcq.exe
%HOMEPATH%\gOEYMkgs\zEEo.exe
%HOMEPATH%\gOEYMkgs\tQck.exe
%HOMEPATH%\gOEYMkgs\YcYe.exe
%HOMEPATH%\gOEYMkgs\dkom.exe
%HOMEPATH%\gOEYMkgs\hUsq.exe
%HOMEPATH%\gOEYMkgs\nksy.exe
%HOMEPATH%\gOEYMkgs\Xwco.exe
%HOMEPATH%\gOEYMkgs\McwG.exe
%HOMEPATH%\gOEYMkgs\cocw.exe
%HOMEPATH%\gOEYMkgs\FYEI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\PAom.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\ZQci.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\sUEO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\KEYA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\dkEq.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\HooC.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\iwEk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\kIMs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%HOMEPATH%\gOEYMkgs\sIIA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\IUYU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\Isww.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\WYAE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%TEMP%\WERd0f8.dir00\appcompat.txt
%TEMP%\WERd0f8.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WERd0f8.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\gkwm.exe
%TEMP%\WERd0f8.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\Egwa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\kEMQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\MAoc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%HOMEPATH%\gOEYMkgs\HMAM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\BQgc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\QIck.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\qwoO.exe
%HOMEPATH%\gOEYMkgs\Xkss.exe
%HOMEPATH%\gOEYMkgs\Noku.exe
%HOMEPATH%\gOEYMkgs\TYIy.exe
%HOMEPATH%\gOEYMkgs\mkQe.exe
%HOMEPATH%\gOEYMkgs\nEUo.exe
%HOMEPATH%\gOEYMkgs\mYwI.exe
%HOMEPATH%\gOEYMkgs\KAcU.exe
%HOMEPATH%\gOEYMkgs\cUQc.exe
<Текущая директория>\<Имя файла>
%HOMEPATH%\gOEYMkgs\HwcS.exe
%TEMP%\WER4a0b.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\ssYE.exe
%HOMEPATH%\gOEYMkgs\eEcw.exe
%HOMEPATH%\gOEYMkgs\dwww.exe
%TEMP%\WER4a0b.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\gUoE.exe
%HOMEPATH%\gOEYMkgs\xgUK.exe
%HOMEPATH%\gOEYMkgs\LIse.exe
%HOMEPATH%\gOEYMkgs\pAgk.exe
%HOMEPATH%\gOEYMkgs\ckUS.exe
%HOMEPATH%\gOEYMkgs\DMUy.exe
%HOMEPATH%\gOEYMkgs\kkIE.exe
%HOMEPATH%\gOEYMkgs\nkIg.exe
%HOMEPATH%\gOEYMkgs\JAMi.exe
%HOMEPATH%\gOEYMkgs\NgsW.exe
%HOMEPATH%\gOEYMkgs\CcwK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%HOMEPATH%\gOEYMkgs\mcsM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\WYUo.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\icMs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\Essk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\Hggk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\Swwy.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\rwUg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\xUES.exe
%HOMEPATH%\gOEYMkgs\UMsi.exe
%HOMEPATH%\gOEYMkgs\hEcm.exe
%HOMEPATH%\gOEYMkgs\DAse.exe
%HOMEPATH%\gOEYMkgs\cQAw.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\fMEQ.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\BMMU.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe

Удаляет следующие файлы:

%HOMEPATH%\gOEYMkgs\aMEY.exe
%HOMEPATH%\gOEYMkgs\UMwM.exe
%HOMEPATH%\gOEYMkgs\SoEm.exe
%HOMEPATH%\gOEYMkgs\AgQM.exe
%HOMEPATH%\gOEYMkgs\NIMO.exe
%HOMEPATH%\gOEYMkgs\fwYY.exe
%HOMEPATH%\gOEYMkgs\JQEs.exe
%HOMEPATH%\gOEYMkgs\qsEQ.exe
%HOMEPATH%\gOEYMkgs\LEUG.exe
%HOMEPATH%\gOEYMkgs\mogM.exe
%HOMEPATH%\gOEYMkgs\SgEu.exe
%HOMEPATH%\gOEYMkgs\pEoK.exe
%HOMEPATH%\gOEYMkgs\UsMm.exe
%HOMEPATH%\gOEYMkgs\IMYu.exe
%HOMEPATH%\gOEYMkgs\TAMs.exe
%HOMEPATH%\gOEYMkgs\NUQE.exe
%HOMEPATH%\gOEYMkgs\igIy.exe
%HOMEPATH%\gOEYMkgs\BQMw.exe
%HOMEPATH%\gOEYMkgs\fkog.exe
%HOMEPATH%\gOEYMkgs\LMUM.exe
%HOMEPATH%\gOEYMkgs\pkoY.exe
%HOMEPATH%\gOEYMkgs\owwK.exe
%HOMEPATH%\gOEYMkgs\FMUi.exe
%HOMEPATH%\gOEYMkgs\rggC.exe
%HOMEPATH%\gOEYMkgs\gUIu.exe
%HOMEPATH%\gOEYMkgs\BQwa.exe
%HOMEPATH%\gOEYMkgs\pQcC.exe
%HOMEPATH%\gOEYMkgs\ygou.exe
%HOMEPATH%\gOEYMkgs\Koky.exe
%HOMEPATH%\gOEYMkgs\pgsk.exe
%HOMEPATH%\gOEYMkgs\BoIe.exe
%HOMEPATH%\gOEYMkgs\qcoM.exe
%HOMEPATH%\gOEYMkgs\PoQy.exe
%HOMEPATH%\gOEYMkgs\dIoK.exe
%HOMEPATH%\gOEYMkgs\UYMA.exe
%HOMEPATH%\gOEYMkgs\hAYy.exe
%HOMEPATH%\gOEYMkgs\nkYa.exe
%HOMEPATH%\gOEYMkgs\Ewgw.exe
%HOMEPATH%\gOEYMkgs\wocM.exe
%HOMEPATH%\gOEYMkgs\hEQs.exe
%HOMEPATH%\gOEYMkgs\FAsK.exe
%HOMEPATH%\gOEYMkgs\egse.exe
%HOMEPATH%\gOEYMkgs\HIAA.exe
%HOMEPATH%\gOEYMkgs\YoYm.exe
%HOMEPATH%\gOEYMkgs\rUcY.exe
%HOMEPATH%\gOEYMkgs\PYIs.exe
%HOMEPATH%\gOEYMkgs\swIU.exe
%HOMEPATH%\gOEYMkgs\ZoYa.exe
%HOMEPATH%\gOEYMkgs\dcoO.exe
%HOMEPATH%\gOEYMkgs\wgwS.exe
%HOMEPATH%\gOEYMkgs\jcAQ.exe
%HOMEPATH%\gOEYMkgs\BIce.exe
%HOMEPATH%\gOEYMkgs\xwok.exe
%HOMEPATH%\gOEYMkgs\SosA.exe
%HOMEPATH%\gOEYMkgs\PIYI.exe
%HOMEPATH%\gOEYMkgs\CUsA.exe
%HOMEPATH%\gOEYMkgs\rcgK.exe
%HOMEPATH%\gOEYMkgs\dkom.exe
%HOMEPATH%\gOEYMkgs\hUsq.exe
%HOMEPATH%\gOEYMkgs\McwG.exe
%HOMEPATH%\gOEYMkgs\cocw.exe
%HOMEPATH%\gOEYMkgs\nksy.exe
%HOMEPATH%\gOEYMkgs\PgQy.exe
%HOMEPATH%\gOEYMkgs\qcwS.exe
%HOMEPATH%\gOEYMkgs\gskY.exe
%HOMEPATH%\gOEYMkgs\ucss.exe
%HOMEPATH%\gOEYMkgs\zEEo.exe
%HOMEPATH%\gOEYMkgs\tQck.exe
%HOMEPATH%\gOEYMkgs\vYMw.exe
%HOMEPATH%\gOEYMkgs\kwEM.exe
%HOMEPATH%\gOEYMkgs\YcYe.exe
%HOMEPATH%\gOEYMkgs\pIcq.exe
%HOMEPATH%\gOEYMkgs\Xwco.exe
%HOMEPATH%\gOEYMkgs\GQUw.exe
%HOMEPATH%\gOEYMkgs\xIsQ.exe
%HOMEPATH%\gOEYMkgs\icMs.exe
%HOMEPATH%\gOEYMkgs\mcsM.exe
%HOMEPATH%\gOEYMkgs\fMEQ.exe
%HOMEPATH%\gOEYMkgs\WYUo.exe
%HOMEPATH%\gOEYMkgs\Hggk.exe
%HOMEPATH%\gOEYMkgs\kIMs.exe
%HOMEPATH%\gOEYMkgs\sIIA.exe
%HOMEPATH%\gOEYMkgs\Swwy.exe
%HOMEPATH%\gOEYMkgs\Essk.exe
%HOMEPATH%\gOEYMkgs\UMsi.exe
%HOMEPATH%\gOEYMkgs\hEcm.exe
%TEMP%\EwYMMgEU.bat
%HOMEPATH%\gOEYMkgs\CcwK.exe
%HOMEPATH%\gOEYMkgs\DAse.exe
%HOMEPATH%\gOEYMkgs\BMMU.exe
%HOMEPATH%\gOEYMkgs\cQAw.exe
%HOMEPATH%\gOEYMkgs\rwUg.exe
%HOMEPATH%\gOEYMkgs\xUES.exe
%HOMEPATH%\gOEYMkgs\iwEk.exe
%HOMEPATH%\gOEYMkgs\HMAM.exe
%HOMEPATH%\gOEYMkgs\kEMQ.exe
%HOMEPATH%\gOEYMkgs\KEYA.exe
%HOMEPATH%\gOEYMkgs\MAoc.exe
%HOMEPATH%\gOEYMkgs\QIck.exe
%HOMEPATH%\gOEYMkgs\Egwa.exe
%HOMEPATH%\gOEYMkgs\gkwm.exe
%HOMEPATH%\gOEYMkgs\qwoO.exe
%HOMEPATH%\gOEYMkgs\BQgc.exe
%HOMEPATH%\gOEYMkgs\IUYU.exe
%HOMEPATH%\gOEYMkgs\HooC.exe
%HOMEPATH%\gOEYMkgs\Isww.exe
%HOMEPATH%\gOEYMkgs\WYAE.exe
%HOMEPATH%\gOEYMkgs\ZQci.exe
%HOMEPATH%\gOEYMkgs\dkEq.exe
%HOMEPATH%\gOEYMkgs\sUEO.exe
%HOMEPATH%\gOEYMkgs\FYEI.exe
%HOMEPATH%\gOEYMkgs\PAom.exe
%HOMEPATH%\gOEYMkgs\cUQc.exe
%HOMEPATH%\gOEYMkgs\XIYg.exe
%HOMEPATH%\gOEYMkgs\Rgke.exe
%HOMEPATH%\gOEYMkgs\RIMO.exe
%HOMEPATH%\gOEYMkgs\zAkY.exe
%HOMEPATH%\gOEYMkgs\gMok.exe
%HOMEPATH%\gOEYMkgs\xgUK.exe
%HOMEPATH%\gOEYMkgs\LIse.exe
%HOMEPATH%\gOEYMkgs\vMMq.exe
%HOMEPATH%\gOEYMkgs\BksA.exe
%HOMEPATH%\gOEYMkgs\zsYK.exe
%HOMEPATH%\gOEYMkgs\HMIK.exe
%HOMEPATH%\gOEYMkgs\TgIA.exe
%HOMEPATH%\gOEYMkgs\PAwg.exe
%HOMEPATH%\gOEYMkgs\wMEu.exe
%HOMEPATH%\gOEYMkgs\JQwC.exe
%HOMEPATH%\gOEYMkgs\HQUA.exe
%HOMEPATH%\gOEYMkgs\VwIu.exe
%HOMEPATH%\gOEYMkgs\tkYo.exe
%HOMEPATH%\gOEYMkgs\pAgk.exe
%HOMEPATH%\gOEYMkgs\mYwI.exe
%HOMEPATH%\gOEYMkgs\Xkss.exe
%HOMEPATH%\gOEYMkgs\mkQe.exe
%HOMEPATH%\gOEYMkgs\nEUo.exe
%HOMEPATH%\gOEYMkgs\Noku.exe
%HOMEPATH%\gOEYMkgs\ssYE.exe
%HOMEPATH%\gOEYMkgs\KAcU.exe
%HOMEPATH%\gOEYMkgs\TYIy.exe
%HOMEPATH%\gOEYMkgs\HwcS.exe
%HOMEPATH%\gOEYMkgs\nkIg.exe
%HOMEPATH%\gOEYMkgs\JAMi.exe
%HOMEPATH%\gOEYMkgs\dwww.exe
%HOMEPATH%\gOEYMkgs\gUoE.exe
%HOMEPATH%\gOEYMkgs\NgsW.exe
%HOMEPATH%\gOEYMkgs\kkIE.exe
%HOMEPATH%\gOEYMkgs\eEcw.exe
%HOMEPATH%\gOEYMkgs\ckUS.exe
%HOMEPATH%\gOEYMkgs\DMUy.exe

Подменяет следующие файлы:

%HOMEPATH%\gOEYMkgs\cUQc.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'74.##5.232.51':443
'ap#.###coincharts.com':443
'74.##5.232.51':80

TCP:

Запросы HTTP GET:

http:/// via 74.##5.232.51
http://google.com/ via 74.##5.232.51

UDP:

DNS ASK ma##.google.com
DNS ASK ap#.###coincharts.com
DNS ASK google.com

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'Run'
ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Open'
ClassName: 'WorkerW' WindowName: ''
ClassName: 'DV2ControlHost' WindowName: ''
ClassName: 'BUTTON' WindowName: 'START'
ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'xSMgIcIg'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: 'Windows Internet Explorer'
ClassName: '' WindowName: 'Open File'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней