Trojan.DownLoader25.17918

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Заражает следующие исполняемые файлы:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Запускает на исполнение:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cmd.exe

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\gOEYMkgs\jYkg.exe
%HOMEPATH%\gOEYMkgs\IgMw.exe
%HOMEPATH%\gOEYMkgs\wcYa.exe
%HOMEPATH%\gOEYMkgs\tcYa.exe
%HOMEPATH%\gOEYMkgs\FMYM.exe
%HOMEPATH%\gOEYMkgs\uAwq.exe
%HOMEPATH%\gOEYMkgs\WcMw.exe
%HOMEPATH%\gOEYMkgs\JgUq.exe
%HOMEPATH%\gOEYMkgs\gkQQ.exe
%HOMEPATH%\gOEYMkgs\UQEK.exe
%HOMEPATH%\gOEYMkgs\ikkg.exe
%HOMEPATH%\gOEYMkgs\jgIQ.exe
%HOMEPATH%\gOEYMkgs\iIoS.exe
%HOMEPATH%\gOEYMkgs\tIQO.exe
%HOMEPATH%\gOEYMkgs\EcgU.exe
%TEMP%\WERec4e.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\Eggs.exe
%HOMEPATH%\gOEYMkgs\uQcG.exe
%HOMEPATH%\gOEYMkgs\AYQU.exe
%TEMP%\WERec4e.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\XcIm.exe
%TEMP%\WERec4e.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\AsUy.exe
%HOMEPATH%\gOEYMkgs\KMcQ.exe
%HOMEPATH%\gOEYMkgs\zQMe.exe
%TEMP%\WERec4e.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER6f3d.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\rEQU.exe
%TEMP%\WER6f3d.dir00\ZgMYMIIE.exe.mdmp
%TEMP%\WER6f3d.dir00\manifest.txt
%TEMP%\WER6f3d.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\jAEW.exe
%HOMEPATH%\gOEYMkgs\pwIA.exe
%HOMEPATH%\gOEYMkgs\GUQo.exe
%HOMEPATH%\gOEYMkgs\nskC.exe
%HOMEPATH%\gOEYMkgs\ZQwQ.exe
%HOMEPATH%\gOEYMkgs\wIkM.exe
%HOMEPATH%\gOEYMkgs\QgUM.exe
%HOMEPATH%\gOEYMkgs\xYsM.exe
%HOMEPATH%\gOEYMkgs\kwkQ.exe
%HOMEPATH%\gOEYMkgs\FcYC.exe
%HOMEPATH%\gOEYMkgs\woMG.exe
%HOMEPATH%\gOEYMkgs\PgAW.exe
%HOMEPATH%\gOEYMkgs\TcsA.exe
%HOMEPATH%\gOEYMkgs\DAkq.exe
%HOMEPATH%\gOEYMkgs\AMEM.exe
%HOMEPATH%\gOEYMkgs\XoIe.exe
%HOMEPATH%\gOEYMkgs\qwkO.exe
%HOMEPATH%\gOEYMkgs\CQkq.exe
%HOMEPATH%\gOEYMkgs\jMgs.exe
%HOMEPATH%\gOEYMkgs\PIsA.exe
%HOMEPATH%\gOEYMkgs\UAwM.exe
%HOMEPATH%\gOEYMkgs\FUwW.exe
%HOMEPATH%\gOEYMkgs\YQsg.exe
%HOMEPATH%\gOEYMkgs\pkIK.exe
%HOMEPATH%\gOEYMkgs\MIAI.exe
%HOMEPATH%\gOEYMkgs\HcgU.exe
%HOMEPATH%\gOEYMkgs\PUAA.exe
%HOMEPATH%\gOEYMkgs\tMAq.exe
%HOMEPATH%\gOEYMkgs\gAcg.exe
%HOMEPATH%\gOEYMkgs\GcAe.exe
%HOMEPATH%\gOEYMkgs\cwgS.exe
%HOMEPATH%\gOEYMkgs\nYIO.exe
%HOMEPATH%\gOEYMkgs\jwco.exe
%HOMEPATH%\gOEYMkgs\OkwU.exe
%HOMEPATH%\gOEYMkgs\xQka.exe
%HOMEPATH%\gOEYMkgs\Pcgu.exe
%HOMEPATH%\gOEYMkgs\sUEY.exe
%HOMEPATH%\gOEYMkgs\roMG.exe
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%HOMEPATH%\gOEYMkgs\Gkok.exe
%HOMEPATH%\gOEYMkgs\DcYg.exe
%HOMEPATH%\gOEYMkgs\foEW.exe
%HOMEPATH%\gOEYMkgs\xgUq.exe
%HOMEPATH%\gOEYMkgs\FEQU.exe
%HOMEPATH%\gOEYMkgs\KsMs.exe
%HOMEPATH%\gOEYMkgs\WQci.exe
%HOMEPATH%\gOEYMkgs\esoE.exe
%HOMEPATH%\gOEYMkgs\LcAI.exe
%HOMEPATH%\gOEYMkgs\tcwk.exe
%HOMEPATH%\gOEYMkgs\FkAu.exe
%HOMEPATH%\gOEYMkgs\EEIc.exe
%HOMEPATH%\gOEYMkgs\ykwW.exe
%HOMEPATH%\gOEYMkgs\FIkC.exe
%HOMEPATH%\gOEYMkgs\xIIE.exe
%HOMEPATH%\gOEYMkgs\FIAO.exe
%HOMEPATH%\gOEYMkgs\MAEy.exe
%HOMEPATH%\gOEYMkgs\pAQc.exe
%HOMEPATH%\gOEYMkgs\PIoE.exe
%HOMEPATH%\gOEYMkgs\ugQq.exe
%HOMEPATH%\gOEYMkgs\aIwu.exe
%HOMEPATH%\gOEYMkgs\sMgW.exe
%HOMEPATH%\gOEYMkgs\WYsE.exe
%HOMEPATH%\gOEYMkgs\JMQK.exe
%HOMEPATH%\gOEYMkgs\bMUm.exe
%HOMEPATH%\gOEYMkgs\pwsA.exe
%HOMEPATH%\gOEYMkgs\ygYs.exe
%HOMEPATH%\gOEYMkgs\yMwC.exe
%HOMEPATH%\gOEYMkgs\GUoa.exe
%HOMEPATH%\gOEYMkgs\UIsI.exe
%HOMEPATH%\gOEYMkgs\BMgW.exe
%HOMEPATH%\gOEYMkgs\JUgS.exe
%HOMEPATH%\gOEYMkgs\bAoY.exe
%HOMEPATH%\gOEYMkgs\rwkc.exe
%HOMEPATH%\gOEYMkgs\vIoM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\TAYM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\VwkI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
<Текущая директория>\<Имя файла>
%HOMEPATH%\gOEYMkgs\joYE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\RAkG.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\mMUw.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\OoAo.exe
%TEMP%\WER807a.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER807a.dir00\appcompat.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\RUsm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%TEMP%\WER807a.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\mMIc.exe
%HOMEPATH%\gOEYMkgs\Ewco.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\kEMC.exe
%TEMP%\WER0e93.dir00\manifest.txt
%TEMP%\WER0e93.dir00\appcompat.txt
%ALLUSERSPROFILE%\caQc.txt
%HOMEPATH%\gOEYMkgs\AwUU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\gsII.exe
%TEMP%\WER0e93.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%TEMP%\WER0e93.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\RAIW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\FIUM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%HOMEPATH%\gOEYMkgs\Yswg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\wIko.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\Bocq.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\xQMI.exe
%TEMP%\WER807a.dir00\manifest.txt
%TEMP%\WERf1c1.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\rcsY.exe
%HOMEPATH%\gOEYMkgs\joAS.exe
%HOMEPATH%\gOEYMkgs\aUYK.exe
%TEMP%\WERf1c1.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\uwYe.exe
%HOMEPATH%\gOEYMkgs\zAcQ.exe
%HOMEPATH%\gOEYMkgs\DUkK.exe
%TEMP%\WERf1c1.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\dYkO.exe
%TEMP%\WERf1c1.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\HQAw.exe
%HOMEPATH%\gOEYMkgs\XIEs.exe
%HOMEPATH%\gOEYMkgs\eskk.exe
%HOMEPATH%\gOEYMkgs\QMEg.exe
%HOMEPATH%\gOEYMkgs\vMAs.exe
%HOMEPATH%\gOEYMkgs\UkYa.exe
%HOMEPATH%\gOEYMkgs\JAgY.exe
%HOMEPATH%\gOEYMkgs\iQIO.exe
%HOMEPATH%\gOEYMkgs\TIEo.exe
%HOMEPATH%\gOEYMkgs\UwYM.exe
%HOMEPATH%\gOEYMkgs\fwws.exe
%HOMEPATH%\gOEYMkgs\Tsou.exe
%HOMEPATH%\gOEYMkgs\tIMo.exe
%HOMEPATH%\gOEYMkgs\DMYM.exe
%HOMEPATH%\gOEYMkgs\FoEs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\xYIK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\GAkQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%HOMEPATH%\gOEYMkgs\pgQw.exe
%HOMEPATH%\gOEYMkgs\XEUY.exe
%HOMEPATH%\gOEYMkgs\poMU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%HOMEPATH%\gOEYMkgs\bQYs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\oUgW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\Ngcc.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\cAci.exe
%HOMEPATH%\gOEYMkgs\fYEQ.exe
%HOMEPATH%\gOEYMkgs\ZoEQ.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\YkMQ.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\OcYM.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\CcwK.exe

Удаляет следующие файлы:

%HOMEPATH%\gOEYMkgs\pAQc.exe
%HOMEPATH%\gOEYMkgs\FUwW.exe
%HOMEPATH%\gOEYMkgs\FIAO.exe
%HOMEPATH%\gOEYMkgs\MAEy.exe
%HOMEPATH%\gOEYMkgs\Eggs.exe
%HOMEPATH%\gOEYMkgs\tIQO.exe
%HOMEPATH%\gOEYMkgs\EcgU.exe
%HOMEPATH%\gOEYMkgs\uQcG.exe
%HOMEPATH%\gOEYMkgs\AYQU.exe
%HOMEPATH%\gOEYMkgs\LcAI.exe
%HOMEPATH%\gOEYMkgs\tcwk.exe
%HOMEPATH%\gOEYMkgs\ykwW.exe
%HOMEPATH%\gOEYMkgs\FIkC.exe
%HOMEPATH%\gOEYMkgs\FkAu.exe
%HOMEPATH%\gOEYMkgs\ugQq.exe
%HOMEPATH%\gOEYMkgs\aIwu.exe
%HOMEPATH%\gOEYMkgs\xIIE.exe
%HOMEPATH%\gOEYMkgs\PIoE.exe
%HOMEPATH%\gOEYMkgs\KMcQ.exe
%HOMEPATH%\gOEYMkgs\jgIQ.exe
%HOMEPATH%\gOEYMkgs\iIoS.exe
%HOMEPATH%\gOEYMkgs\WcMw.exe
%HOMEPATH%\gOEYMkgs\ikkg.exe
%HOMEPATH%\gOEYMkgs\JgUq.exe
%HOMEPATH%\gOEYMkgs\PgAW.exe
%HOMEPATH%\gOEYMkgs\TcsA.exe
%HOMEPATH%\gOEYMkgs\gkQQ.exe
%HOMEPATH%\gOEYMkgs\UQEK.exe
%HOMEPATH%\gOEYMkgs\AsUy.exe
%HOMEPATH%\gOEYMkgs\tcYa.exe
%HOMEPATH%\gOEYMkgs\zQMe.exe
%HOMEPATH%\gOEYMkgs\XcIm.exe
%HOMEPATH%\gOEYMkgs\FMYM.exe
%HOMEPATH%\gOEYMkgs\IgMw.exe
%HOMEPATH%\gOEYMkgs\wcYa.exe
%HOMEPATH%\gOEYMkgs\uAwq.exe
%HOMEPATH%\gOEYMkgs\jYkg.exe
%HOMEPATH%\gOEYMkgs\EEIc.exe
%HOMEPATH%\gOEYMkgs\HcgU.exe
%HOMEPATH%\gOEYMkgs\PUAA.exe
%HOMEPATH%\gOEYMkgs\xgUq.exe
%HOMEPATH%\gOEYMkgs\FEQU.exe
%HOMEPATH%\gOEYMkgs\tMAq.exe
%HOMEPATH%\gOEYMkgs\MIAI.exe
%HOMEPATH%\gOEYMkgs\gAcg.exe
%HOMEPATH%\gOEYMkgs\YQsg.exe
%HOMEPATH%\gOEYMkgs\pkIK.exe
%HOMEPATH%\gOEYMkgs\sUEY.exe
%HOMEPATH%\gOEYMkgs\roMG.exe
%HOMEPATH%\gOEYMkgs\Gkok.exe
%HOMEPATH%\gOEYMkgs\Pcgu.exe
%HOMEPATH%\gOEYMkgs\DcYg.exe
%HOMEPATH%\gOEYMkgs\esoE.exe
%HOMEPATH%\gOEYMkgs\foEW.exe
%HOMEPATH%\gOEYMkgs\KsMs.exe
%HOMEPATH%\gOEYMkgs\WQci.exe
%HOMEPATH%\gOEYMkgs\jwco.exe
%HOMEPATH%\gOEYMkgs\yMwC.exe
%HOMEPATH%\gOEYMkgs\JUgS.exe
%HOMEPATH%\gOEYMkgs\WYsE.exe
%HOMEPATH%\gOEYMkgs\JMQK.exe
%HOMEPATH%\gOEYMkgs\bAoY.exe
%HOMEPATH%\gOEYMkgs\UIsI.exe
%HOMEPATH%\gOEYMkgs\BMgW.exe
%HOMEPATH%\gOEYMkgs\rwkc.exe
%HOMEPATH%\gOEYMkgs\GUoa.exe
%HOMEPATH%\gOEYMkgs\GcAe.exe
%HOMEPATH%\gOEYMkgs\cwgS.exe
%HOMEPATH%\gOEYMkgs\OkwU.exe
%HOMEPATH%\gOEYMkgs\xQka.exe
%HOMEPATH%\gOEYMkgs\nYIO.exe
%HOMEPATH%\gOEYMkgs\ygYs.exe
%HOMEPATH%\gOEYMkgs\sMgW.exe
%HOMEPATH%\gOEYMkgs\bMUm.exe
%HOMEPATH%\gOEYMkgs\pwsA.exe
%HOMEPATH%\gOEYMkgs\DAkq.exe
%HOMEPATH%\gOEYMkgs\pgQw.exe
%HOMEPATH%\gOEYMkgs\xYIK.exe
%HOMEPATH%\gOEYMkgs\YkMQ.exe
%HOMEPATH%\gOEYMkgs\GAkQ.exe
%HOMEPATH%\gOEYMkgs\XEUY.exe
%HOMEPATH%\gOEYMkgs\bQYs.exe
%HOMEPATH%\gOEYMkgs\RUsm.exe
%HOMEPATH%\gOEYMkgs\oUgW.exe
%HOMEPATH%\gOEYMkgs\poMU.exe
%HOMEPATH%\gOEYMkgs\dYkO.exe
%HOMEPATH%\gOEYMkgs\fYEQ.exe
%HOMEPATH%\gOEYMkgs\XIEs.exe
%HOMEPATH%\gOEYMkgs\DUkK.exe
%HOMEPATH%\gOEYMkgs\ZoEQ.exe
%HOMEPATH%\gOEYMkgs\OcYM.exe
%HOMEPATH%\gOEYMkgs\CcwK.exe
%HOMEPATH%\gOEYMkgs\Ngcc.exe
%HOMEPATH%\gOEYMkgs\cAci.exe
%HOMEPATH%\gOEYMkgs\OoAo.exe
%HOMEPATH%\gOEYMkgs\RAIW.exe
%HOMEPATH%\gOEYMkgs\FIUM.exe
%HOMEPATH%\gOEYMkgs\RAkG.exe
%HOMEPATH%\gOEYMkgs\Yswg.exe
%HOMEPATH%\gOEYMkgs\Bocq.exe
%HOMEPATH%\gOEYMkgs\AwUU.exe
%HOMEPATH%\gOEYMkgs\gsII.exe
%HOMEPATH%\gOEYMkgs\xQMI.exe
%HOMEPATH%\gOEYMkgs\wIko.exe
%HOMEPATH%\gOEYMkgs\mMIc.exe
%HOMEPATH%\gOEYMkgs\VwkI.exe
%HOMEPATH%\gOEYMkgs\Ewco.exe
%HOMEPATH%\gOEYMkgs\kEMC.exe
%HOMEPATH%\gOEYMkgs\vIoM.exe
%HOMEPATH%\gOEYMkgs\mMUw.exe
%HOMEPATH%\gOEYMkgs\joYE.exe
%HOMEPATH%\gOEYMkgs\TAYM.exe
%TEMP%\MsEYQwoY.bat
%HOMEPATH%\gOEYMkgs\HQAw.exe
%HOMEPATH%\gOEYMkgs\rEQU.exe
%HOMEPATH%\gOEYMkgs\pwIA.exe
%HOMEPATH%\gOEYMkgs\CQkq.exe
%HOMEPATH%\gOEYMkgs\jAEW.exe
%HOMEPATH%\gOEYMkgs\wIkM.exe
%HOMEPATH%\gOEYMkgs\GUQo.exe
%HOMEPATH%\gOEYMkgs\nskC.exe
%HOMEPATH%\gOEYMkgs\QgUM.exe
%HOMEPATH%\gOEYMkgs\xYsM.exe
%HOMEPATH%\gOEYMkgs\woMG.exe
%HOMEPATH%\gOEYMkgs\AMEM.exe
%HOMEPATH%\gOEYMkgs\kwkQ.exe
%HOMEPATH%\gOEYMkgs\FcYC.exe
%HOMEPATH%\gOEYMkgs\jMgs.exe
%HOMEPATH%\gOEYMkgs\XoIe.exe
%HOMEPATH%\gOEYMkgs\qwkO.exe
%HOMEPATH%\gOEYMkgs\PIsA.exe
%HOMEPATH%\gOEYMkgs\UAwM.exe
%HOMEPATH%\gOEYMkgs\ZQwQ.exe
%HOMEPATH%\gOEYMkgs\fwws.exe
%HOMEPATH%\gOEYMkgs\Tsou.exe
%HOMEPATH%\gOEYMkgs\FoEs.exe
%HOMEPATH%\gOEYMkgs\UwYM.exe
%HOMEPATH%\gOEYMkgs\aUYK.exe
%HOMEPATH%\gOEYMkgs\joAS.exe
%HOMEPATH%\gOEYMkgs\zAcQ.exe
%HOMEPATH%\gOEYMkgs\uwYe.exe
%HOMEPATH%\gOEYMkgs\rcsY.exe
%HOMEPATH%\gOEYMkgs\iQIO.exe
%HOMEPATH%\gOEYMkgs\eskk.exe
%HOMEPATH%\gOEYMkgs\UkYa.exe
%HOMEPATH%\gOEYMkgs\JAgY.exe
%HOMEPATH%\gOEYMkgs\QMEg.exe
%HOMEPATH%\gOEYMkgs\tIMo.exe
%HOMEPATH%\gOEYMkgs\DMYM.exe
%HOMEPATH%\gOEYMkgs\vMAs.exe
%HOMEPATH%\gOEYMkgs\TIEo.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'74.##5.232.51':443
'ap#.###coincharts.com':443
'74.##5.232.51':80

TCP:

Запросы HTTP GET:

http://google.com/ via 74.##5.232.51
http:/// via 74.##5.232.51

UDP:

DNS ASK ma##.google.com
DNS ASK ap#.###coincharts.com
DNS ASK google.com

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'Run'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: '' WindowName: 'Open'
ClassName: 'WorkerW' WindowName: ''
ClassName: 'DV2ControlHost' WindowName: ''
ClassName: 'BUTTON' WindowName: 'START'
ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'xSMgIcIg'
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Windows Internet Explorer'
ClassName: '' WindowName: 'Open File'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней