Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
- <STUBS_DIR>\test.exe
- C:\Far2\Far.exe
- скрытых файлов
- расширений файлов
- Средство контроля пользовательских учетных записей (UAC)
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- %HOMEPATH%\gOEYMkgs\IAoo.exe
- %HOMEPATH%\gOEYMkgs\ukss.exe
- %HOMEPATH%\gOEYMkgs\XIoK.exe
- %HOMEPATH%\gOEYMkgs\YwwG.exe
- %HOMEPATH%\gOEYMkgs\NUcW.exe
- %HOMEPATH%\gOEYMkgs\FIYi.exe
- %HOMEPATH%\gOEYMkgs\VoUA.exe
- %HOMEPATH%\gOEYMkgs\Owsk.exe
- %HOMEPATH%\gOEYMkgs\kkAK.exe
- %HOMEPATH%\gOEYMkgs\rggk.exe
- %HOMEPATH%\gOEYMkgs\rYsU.exe
- %HOMEPATH%\gOEYMkgs\vwsw.exe
- %HOMEPATH%\gOEYMkgs\dEMI.exe
- %HOMEPATH%\gOEYMkgs\OEcq.exe
- %HOMEPATH%\gOEYMkgs\Rocg.exe
- %HOMEPATH%\gOEYMkgs\qEMs.exe
- %HOMEPATH%\gOEYMkgs\LgII.exe
- %HOMEPATH%\gOEYMkgs\jwEy.exe
- %HOMEPATH%\gOEYMkgs\jsEG.exe
- %HOMEPATH%\gOEYMkgs\LYcE.exe
- %HOMEPATH%\gOEYMkgs\UgAs.exe
- %HOMEPATH%\gOEYMkgs\ywQC.exe
- %HOMEPATH%\gOEYMkgs\ksIs.exe
- %HOMEPATH%\gOEYMkgs\WksC.exe
- %HOMEPATH%\gOEYMkgs\lwUe.exe
- %HOMEPATH%\gOEYMkgs\KQka.exe
- %HOMEPATH%\gOEYMkgs\MAEq.exe
- %HOMEPATH%\gOEYMkgs\KYoC.exe
- %HOMEPATH%\gOEYMkgs\XQwq.exe
- %HOMEPATH%\gOEYMkgs\zgAe.exe
- %HOMEPATH%\gOEYMkgs\BQwK.exe
- %HOMEPATH%\gOEYMkgs\mYQO.exe
- %HOMEPATH%\gOEYMkgs\pksG.exe
- %HOMEPATH%\gOEYMkgs\ggwo.exe
- %HOMEPATH%\gOEYMkgs\nQAU.exe
- %HOMEPATH%\gOEYMkgs\Pckk.exe
- %HOMEPATH%\gOEYMkgs\xcAY.exe
- %HOMEPATH%\gOEYMkgs\dUIW.exe
- C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
- %HOMEPATH%\gOEYMkgs\bMwK.exe
- %HOMEPATH%\gOEYMkgs\IoYg.exe
- %HOMEPATH%\gOEYMkgs\BMIE.exe
- %HOMEPATH%\gOEYMkgs\mIgk.exe
- %HOMEPATH%\gOEYMkgs\BIoy.exe
- %HOMEPATH%\gOEYMkgs\oAoG.exe
- %HOMEPATH%\gOEYMkgs\jggK.exe
- %HOMEPATH%\gOEYMkgs\MMQE.exe
- %HOMEPATH%\gOEYMkgs\fcQQ.exe
- %HOMEPATH%\gOEYMkgs\WMca.exe
- %HOMEPATH%\gOEYMkgs\EoIe.exe
- %HOMEPATH%\gOEYMkgs\qcEw.exe
- %HOMEPATH%\gOEYMkgs\DAoK.exe
- %HOMEPATH%\gOEYMkgs\EsQo.exe
- %HOMEPATH%\gOEYMkgs\poQu.exe
- %HOMEPATH%\gOEYMkgs\IUow.exe
- %HOMEPATH%\gOEYMkgs\PsUk.exe
- %HOMEPATH%\gOEYMkgs\asww.exe
- %HOMEPATH%\gOEYMkgs\vMki.exe
- %HOMEPATH%\gOEYMkgs\zkkU.exe
- %HOMEPATH%\gOEYMkgs\iMAs.exe
- %HOMEPATH%\gOEYMkgs\fkYs.exe
- %HOMEPATH%\gOEYMkgs\WYcG.exe
- %HOMEPATH%\gOEYMkgs\VwMw.exe
- %HOMEPATH%\gOEYMkgs\PYgS.exe
- %HOMEPATH%\gOEYMkgs\lUcO.exe
- %HOMEPATH%\gOEYMkgs\JUkY.exe
- %HOMEPATH%\gOEYMkgs\OkQI.exe
- %HOMEPATH%\gOEYMkgs\iUQU.exe
- %HOMEPATH%\gOEYMkgs\MYwe.exe
- %HOMEPATH%\gOEYMkgs\aEsE.exe
- %HOMEPATH%\gOEYMkgs\rosy.exe
- %HOMEPATH%\gOEYMkgs\eIYG.exe
- %HOMEPATH%\gOEYMkgs\rkgA.exe
- %HOMEPATH%\gOEYMkgs\vooS.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
- %HOMEPATH%\gOEYMkgs\qcwe.exe
- %HOMEPATH%\gOEYMkgs\uMYo.exe
- %HOMEPATH%\gOEYMkgs\LMAw.exe
- %HOMEPATH%\gOEYMkgs\Mkgm.exe
- %HOMEPATH%\gOEYMkgs\pQQM.exe
- %HOMEPATH%\gOEYMkgs\ucok.exe
- %HOMEPATH%\gOEYMkgs\AkMy.exe
- %HOMEPATH%\gOEYMkgs\lcEk.exe
- %HOMEPATH%\gOEYMkgs\TEUq.exe
- %HOMEPATH%\gOEYMkgs\aYIQ.exe
- %HOMEPATH%\gOEYMkgs\iswg.exe
- %HOMEPATH%\gOEYMkgs\jgci.exe
- %HOMEPATH%\gOEYMkgs\oUgQ.exe
- %HOMEPATH%\gOEYMkgs\rskc.exe
- %HOMEPATH%\gOEYMkgs\uEYo.exe
- %HOMEPATH%\gOEYMkgs\ZQsq.exe
- %HOMEPATH%\gOEYMkgs\ZwwG.exe
- %HOMEPATH%\gOEYMkgs\rUoi.exe
- %HOMEPATH%\gOEYMkgs\bcwC.exe
- %HOMEPATH%\gOEYMkgs\cwkU.exe
- %HOMEPATH%\gOEYMkgs\rQAW.exe
- %HOMEPATH%\gOEYMkgs\HcEo.exe
- %HOMEPATH%\gOEYMkgs\mksw.exe
- %HOMEPATH%\gOEYMkgs\nYYk.exe
- %HOMEPATH%\gOEYMkgs\pMoY.exe
- %HOMEPATH%\gOEYMkgs\Ogci.exe
- %HOMEPATH%\gOEYMkgs\AcYo.exe
- %HOMEPATH%\gOEYMkgs\sUos.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %HOMEPATH%\gOEYMkgs\pEQW.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %HOMEPATH%\gOEYMkgs\Poki.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %HOMEPATH%\gOEYMkgs\ikgm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %HOMEPATH%\gOEYMkgs\CYwK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %HOMEPATH%\gOEYMkgs\lAoa.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %HOMEPATH%\gOEYMkgs\xYwy.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %HOMEPATH%\gOEYMkgs\XYYW.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %HOMEPATH%\gOEYMkgs\NUca.exe
- %HOMEPATH%\gOEYMkgs\JUUm.exe
- %TEMP%\WER18a4.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %HOMEPATH%\gOEYMkgs\gUoA.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %HOMEPATH%\gOEYMkgs\GUgO.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %HOMEPATH%\gOEYMkgs\ekgm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %HOMEPATH%\gOEYMkgs\AYYY.exe
- %TEMP%\WER2811.dir00\manifest.txt
- %TEMP%\WER2811.dir00\appcompat.txt
- %TEMP%\WER2811.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WERa1bf.dir00\ZgMYMIIE.exe.mdmp
- <Текущая директория>\<Имя файла>
- %ALLUSERSPROFILE%\caQc.txt
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %TEMP%\WER2811.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %TEMP%\WERa1bf.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\dkgA.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %HOMEPATH%\gOEYMkgs\GcUw.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %HOMEPATH%\gOEYMkgs\KUcC.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %HOMEPATH%\gOEYMkgs\rEMg.exe
- %TEMP%\WERa1bf.dir00\manifest.txt
- %TEMP%\WERa1bf.dir00\appcompat.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %HOMEPATH%\gOEYMkgs\vQEg.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %HOMEPATH%\gOEYMkgs\UAoS.exe
- %HOMEPATH%\gOEYMkgs\dssA.exe
- %HOMEPATH%\gOEYMkgs\GcgQ.exe
- %HOMEPATH%\gOEYMkgs\XkgG.exe
- %TEMP%\WER9520.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\CYIG.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %HOMEPATH%\gOEYMkgs\SEMM.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %HOMEPATH%\gOEYMkgs\ZEgG.exe
- %HOMEPATH%\gOEYMkgs\OoUU.exe
- %HOMEPATH%\gOEYMkgs\ccIm.exe
- %TEMP%\WER9520.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\iMEQ.exe
- %HOMEPATH%\gOEYMkgs\Lssc.exe
- %HOMEPATH%\gOEYMkgs\mEUI.exe
- %HOMEPATH%\gOEYMkgs\dkcO.exe
- %HOMEPATH%\gOEYMkgs\IscO.exe
- %HOMEPATH%\gOEYMkgs\eYQe.exe
- %TEMP%\WER9520.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\Rswc.exe
- %HOMEPATH%\gOEYMkgs\jgkO.exe
- %HOMEPATH%\gOEYMkgs\IAgu.exe
- %HOMEPATH%\gOEYMkgs\Ksge.exe
- %TEMP%\WER9520.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\pUUM.exe
- %TEMP%\WER18a4.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\bIkQ.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\LsUO.exe
- %TEMP%\WER18a4.dir00\manifest.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %HOMEPATH%\gOEYMkgs\zcIM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %HOMEPATH%\gOEYMkgs\ZgIK.exe
- %TEMP%\WER18a4.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\icYM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %HOMEPATH%\gOEYMkgs\FYME.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %HOMEPATH%\gOEYMkgs\TEsO.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %HOMEPATH%\gOEYMkgs\aUEo.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %HOMEPATH%\gOEYMkgs\XgwY.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\AYgy.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %HOMEPATH%\gOEYMkgs\nwEG.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %HOMEPATH%\gOEYMkgs\jgci.exe
- %HOMEPATH%\gOEYMkgs\DAoK.exe
- %HOMEPATH%\gOEYMkgs\aYIQ.exe
- %HOMEPATH%\gOEYMkgs\iswg.exe
- %HOMEPATH%\gOEYMkgs\LgII.exe
- %HOMEPATH%\gOEYMkgs\OEcq.exe
- %HOMEPATH%\gOEYMkgs\Rocg.exe
- %HOMEPATH%\gOEYMkgs\jwEy.exe
- %HOMEPATH%\gOEYMkgs\jsEG.exe
- %HOMEPATH%\gOEYMkgs\TEUq.exe
- %HOMEPATH%\gOEYMkgs\Mkgm.exe
- %HOMEPATH%\gOEYMkgs\AkMy.exe
- %HOMEPATH%\gOEYMkgs\lcEk.exe
- %HOMEPATH%\gOEYMkgs\pQQM.exe
- %HOMEPATH%\gOEYMkgs\rskc.exe
- %HOMEPATH%\gOEYMkgs\uEYo.exe
- %HOMEPATH%\gOEYMkgs\ucok.exe
- %HOMEPATH%\gOEYMkgs\oUgQ.exe
- %HOMEPATH%\gOEYMkgs\qEMs.exe
- %HOMEPATH%\gOEYMkgs\ukss.exe
- %HOMEPATH%\gOEYMkgs\XIoK.exe
- %HOMEPATH%\gOEYMkgs\FIYi.exe
- %HOMEPATH%\gOEYMkgs\IAoo.exe
- %HOMEPATH%\gOEYMkgs\rggk.exe
- %HOMEPATH%\gOEYMkgs\VoUA.exe
- %HOMEPATH%\gOEYMkgs\Owsk.exe
- %HOMEPATH%\gOEYMkgs\rYsU.exe
- %HOMEPATH%\gOEYMkgs\vwsw.exe
- %HOMEPATH%\gOEYMkgs\lwUe.exe
- %HOMEPATH%\gOEYMkgs\LYcE.exe
- %HOMEPATH%\gOEYMkgs\ksIs.exe
- %HOMEPATH%\gOEYMkgs\WksC.exe
- %HOMEPATH%\gOEYMkgs\UgAs.exe
- %HOMEPATH%\gOEYMkgs\YwwG.exe
- %HOMEPATH%\gOEYMkgs\NUcW.exe
- %HOMEPATH%\gOEYMkgs\ywQC.exe
- %HOMEPATH%\gOEYMkgs\dEMI.exe
- %HOMEPATH%\gOEYMkgs\ZQsq.exe
- %HOMEPATH%\gOEYMkgs\lUcO.exe
- %HOMEPATH%\gOEYMkgs\PsUk.exe
- %HOMEPATH%\gOEYMkgs\rkgA.exe
- %HOMEPATH%\gOEYMkgs\vooS.exe
- %HOMEPATH%\gOEYMkgs\asww.exe
- %HOMEPATH%\gOEYMkgs\poQu.exe
- %HOMEPATH%\gOEYMkgs\IUow.exe
- %HOMEPATH%\gOEYMkgs\vMki.exe
- %HOMEPATH%\gOEYMkgs\EsQo.exe
- %HOMEPATH%\gOEYMkgs\rosy.exe
- %HOMEPATH%\gOEYMkgs\JUkY.exe
- %HOMEPATH%\gOEYMkgs\MYwe.exe
- %HOMEPATH%\gOEYMkgs\aEsE.exe
- %HOMEPATH%\gOEYMkgs\OkQI.exe
- %HOMEPATH%\gOEYMkgs\uMYo.exe
- %HOMEPATH%\gOEYMkgs\eIYG.exe
- %HOMEPATH%\gOEYMkgs\iUQU.exe
- %HOMEPATH%\gOEYMkgs\qcwe.exe
- %HOMEPATH%\gOEYMkgs\WYcG.exe
- %HOMEPATH%\gOEYMkgs\bcwC.exe
- %HOMEPATH%\gOEYMkgs\Ogci.exe
- %HOMEPATH%\gOEYMkgs\ZwwG.exe
- %HOMEPATH%\gOEYMkgs\rUoi.exe
- %HOMEPATH%\gOEYMkgs\AcYo.exe
- %HOMEPATH%\gOEYMkgs\nYYk.exe
- %HOMEPATH%\gOEYMkgs\pMoY.exe
- %HOMEPATH%\gOEYMkgs\sUos.exe
- %HOMEPATH%\gOEYMkgs\mksw.exe
- %HOMEPATH%\gOEYMkgs\zkkU.exe
- %HOMEPATH%\gOEYMkgs\iMAs.exe
- %HOMEPATH%\gOEYMkgs\VwMw.exe
- %HOMEPATH%\gOEYMkgs\PYgS.exe
- %HOMEPATH%\gOEYMkgs\fkYs.exe
- %HOMEPATH%\gOEYMkgs\rQAW.exe
- %HOMEPATH%\gOEYMkgs\HcEo.exe
- %HOMEPATH%\gOEYMkgs\LMAw.exe
- %HOMEPATH%\gOEYMkgs\cwkU.exe
- %HOMEPATH%\gOEYMkgs\kkAK.exe
- %HOMEPATH%\gOEYMkgs\XgwY.exe
- %HOMEPATH%\gOEYMkgs\AYgy.exe
- %HOMEPATH%\gOEYMkgs\TEsO.exe
- %HOMEPATH%\gOEYMkgs\nwEG.exe
- %HOMEPATH%\gOEYMkgs\LsUO.exe
- %HOMEPATH%\gOEYMkgs\zcIM.exe
- %HOMEPATH%\gOEYMkgs\ZgIK.exe
- %HOMEPATH%\gOEYMkgs\bIkQ.exe
- %HOMEPATH%\gOEYMkgs\icYM.exe
- %HOMEPATH%\gOEYMkgs\ZEgG.exe
- %HOMEPATH%\gOEYMkgs\OoUU.exe
- %HOMEPATH%\gOEYMkgs\dssA.exe
- %HOMEPATH%\gOEYMkgs\GcgQ.exe
- %HOMEPATH%\gOEYMkgs\ccIm.exe
- %HOMEPATH%\gOEYMkgs\aUEo.exe
- %HOMEPATH%\gOEYMkgs\FYME.exe
- %HOMEPATH%\gOEYMkgs\SEMM.exe
- %HOMEPATH%\gOEYMkgs\pUUM.exe
- %HOMEPATH%\gOEYMkgs\JUUm.exe
- %HOMEPATH%\gOEYMkgs\AYYY.exe
- %HOMEPATH%\gOEYMkgs\KUcC.exe
- %HOMEPATH%\gOEYMkgs\xYwy.exe
- %HOMEPATH%\gOEYMkgs\CYwK.exe
- %HOMEPATH%\gOEYMkgs\dkgA.exe
- %HOMEPATH%\gOEYMkgs\rEMg.exe
- %TEMP%\dywEkQYs.bat
- %HOMEPATH%\gOEYMkgs\GcUw.exe
- %HOMEPATH%\gOEYMkgs\vQEg.exe
- %HOMEPATH%\gOEYMkgs\ekgm.exe
- %HOMEPATH%\gOEYMkgs\gUoA.exe
- %HOMEPATH%\gOEYMkgs\XYYW.exe
- %HOMEPATH%\gOEYMkgs\NUca.exe
- %HOMEPATH%\gOEYMkgs\GUgO.exe
- %HOMEPATH%\gOEYMkgs\pEQW.exe
- %HOMEPATH%\gOEYMkgs\lAoa.exe
- %HOMEPATH%\gOEYMkgs\Poki.exe
- %HOMEPATH%\gOEYMkgs\ikgm.exe
- %HOMEPATH%\gOEYMkgs\UAoS.exe
- %HOMEPATH%\gOEYMkgs\MMQE.exe
- %HOMEPATH%\gOEYMkgs\fcQQ.exe
- %HOMEPATH%\gOEYMkgs\qcEw.exe
- %HOMEPATH%\gOEYMkgs\jggK.exe
- %HOMEPATH%\gOEYMkgs\zgAe.exe
- %HOMEPATH%\gOEYMkgs\MAEq.exe
- %HOMEPATH%\gOEYMkgs\KYoC.exe
- %HOMEPATH%\gOEYMkgs\BQwK.exe
- %HOMEPATH%\gOEYMkgs\mYQO.exe
- %HOMEPATH%\gOEYMkgs\BIoy.exe
- %HOMEPATH%\gOEYMkgs\oAoG.exe
- %HOMEPATH%\gOEYMkgs\KQka.exe
- %HOMEPATH%\gOEYMkgs\mIgk.exe
- %HOMEPATH%\gOEYMkgs\bMwK.exe
- %HOMEPATH%\gOEYMkgs\WMca.exe
- %HOMEPATH%\gOEYMkgs\EoIe.exe
- %HOMEPATH%\gOEYMkgs\IoYg.exe
- %HOMEPATH%\gOEYMkgs\BMIE.exe
- %HOMEPATH%\gOEYMkgs\XQwq.exe
- %HOMEPATH%\gOEYMkgs\mEUI.exe
- %HOMEPATH%\gOEYMkgs\IAgu.exe
- %HOMEPATH%\gOEYMkgs\iMEQ.exe
- %HOMEPATH%\gOEYMkgs\Lssc.exe
- %HOMEPATH%\gOEYMkgs\Ksge.exe
- %HOMEPATH%\gOEYMkgs\XkgG.exe
- %HOMEPATH%\gOEYMkgs\CYIG.exe
- %HOMEPATH%\gOEYMkgs\Rswc.exe
- %HOMEPATH%\gOEYMkgs\jgkO.exe
- %HOMEPATH%\gOEYMkgs\dUIW.exe
- %HOMEPATH%\gOEYMkgs\pksG.exe
- %HOMEPATH%\gOEYMkgs\Pckk.exe
- %HOMEPATH%\gOEYMkgs\xcAY.exe
- %HOMEPATH%\gOEYMkgs\ggwo.exe
- %HOMEPATH%\gOEYMkgs\IscO.exe
- %HOMEPATH%\gOEYMkgs\eYQe.exe
- %HOMEPATH%\gOEYMkgs\nQAU.exe
- %HOMEPATH%\gOEYMkgs\dkcO.exe
- '74.##5.232.51':80
- http://google.com/ via 74.##5.232.51
- http:/// via 74.##5.232.51
- DNS ASK google.com
- ClassName: '' WindowName: 'lacMcYws.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'SSIkQYgQ.exe'