Trojan.DownLoader25.17973

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Заражает следующие исполняемые файлы:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Запускает на исполнение:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\gOEYMkgs\GwsW.exe
%HOMEPATH%\gOEYMkgs\QEkk.exe
%HOMEPATH%\gOEYMkgs\hMgy.exe
%HOMEPATH%\gOEYMkgs\dYcm.exe
%HOMEPATH%\gOEYMkgs\ngEW.exe
%HOMEPATH%\gOEYMkgs\DUkQ.exe
%HOMEPATH%\gOEYMkgs\SYUg.exe
%HOMEPATH%\gOEYMkgs\DQoi.exe
%HOMEPATH%\gOEYMkgs\SIoe.exe
%HOMEPATH%\gOEYMkgs\DYYc.exe
%HOMEPATH%\gOEYMkgs\HYoY.exe
%HOMEPATH%\gOEYMkgs\hsMY.exe
%HOMEPATH%\gOEYMkgs\VAEc.exe
%HOMEPATH%\gOEYMkgs\CAco.exe
%HOMEPATH%\gOEYMkgs\Okwm.exe
%HOMEPATH%\gOEYMkgs\xAEa.exe
%HOMEPATH%\gOEYMkgs\ogAG.exe
%HOMEPATH%\gOEYMkgs\Agcy.exe
%HOMEPATH%\gOEYMkgs\QUwO.exe
%HOMEPATH%\gOEYMkgs\psUI.exe
%HOMEPATH%\gOEYMkgs\hEco.exe
%HOMEPATH%\gOEYMkgs\pMEM.exe
%HOMEPATH%\gOEYMkgs\icII.exe
%HOMEPATH%\gOEYMkgs\askO.exe
%HOMEPATH%\gOEYMkgs\agso.exe
%HOMEPATH%\gOEYMkgs\yEAE.exe
%HOMEPATH%\gOEYMkgs\XQoO.exe
%HOMEPATH%\gOEYMkgs\sMka.exe
%HOMEPATH%\gOEYMkgs\bwIs.exe
%HOMEPATH%\gOEYMkgs\gEUA.exe
%HOMEPATH%\gOEYMkgs\VccK.exe
%HOMEPATH%\gOEYMkgs\YsIs.exe
%HOMEPATH%\gOEYMkgs\xQca.exe
%HOMEPATH%\gOEYMkgs\lMgk.exe
%HOMEPATH%\gOEYMkgs\LIEA.exe
%HOMEPATH%\gOEYMkgs\hkMI.exe
%HOMEPATH%\gOEYMkgs\DAUI.exe
%HOMEPATH%\gOEYMkgs\ZAAO.exe
%HOMEPATH%\gOEYMkgs\zQEI.exe
%HOMEPATH%\gOEYMkgs\gQYk.exe
%HOMEPATH%\gOEYMkgs\xYoM.exe
%HOMEPATH%\gOEYMkgs\lAAu.exe
%HOMEPATH%\gOEYMkgs\gkQk.exe
%HOMEPATH%\gOEYMkgs\BIMa.exe
%HOMEPATH%\gOEYMkgs\MMQO.exe
%HOMEPATH%\gOEYMkgs\TMEi.exe
%HOMEPATH%\gOEYMkgs\SQcQ.exe
%HOMEPATH%\gOEYMkgs\XcoK.exe
%HOMEPATH%\gOEYMkgs\tQMc.exe
%HOMEPATH%\gOEYMkgs\JsQg.exe
%HOMEPATH%\gOEYMkgs\ekQS.exe
%HOMEPATH%\gOEYMkgs\kAcM.exe
%HOMEPATH%\gOEYMkgs\JQIe.exe
%HOMEPATH%\gOEYMkgs\OYAm.exe
%HOMEPATH%\gOEYMkgs\DoYo.exe
%HOMEPATH%\gOEYMkgs\mEEM.exe
%HOMEPATH%\gOEYMkgs\aYQi.exe
%HOMEPATH%\gOEYMkgs\twgI.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%HOMEPATH%\gOEYMkgs\dEUq.exe
%HOMEPATH%\gOEYMkgs\LYMq.exe
%HOMEPATH%\gOEYMkgs\xcIa.exe
%HOMEPATH%\gOEYMkgs\hIUM.exe
%HOMEPATH%\gOEYMkgs\cUom.exe
%HOMEPATH%\gOEYMkgs\OYco.exe
%HOMEPATH%\gOEYMkgs\ywQC.exe
%HOMEPATH%\gOEYMkgs\OEQO.exe
%HOMEPATH%\gOEYMkgs\XQIC.exe
%HOMEPATH%\gOEYMkgs\VAoe.exe
%HOMEPATH%\gOEYMkgs\zYoK.exe
%HOMEPATH%\gOEYMkgs\LgYe.exe
%HOMEPATH%\gOEYMkgs\tQQo.exe
%HOMEPATH%\gOEYMkgs\Wcsc.exe
%HOMEPATH%\gOEYMkgs\ZcIk.exe
%HOMEPATH%\gOEYMkgs\SsoU.exe
%HOMEPATH%\gOEYMkgs\HkUk.exe
%HOMEPATH%\gOEYMkgs\HAcq.exe
%HOMEPATH%\gOEYMkgs\mcIi.exe
%HOMEPATH%\gOEYMkgs\oAsC.exe
%HOMEPATH%\gOEYMkgs\Mkgs.exe
%HOMEPATH%\gOEYMkgs\XsYM.exe
%HOMEPATH%\gOEYMkgs\OkAC.exe
%HOMEPATH%\gOEYMkgs\coYM.exe
%HOMEPATH%\gOEYMkgs\DAUY.exe
%HOMEPATH%\gOEYMkgs\bgws.exe
%HOMEPATH%\gOEYMkgs\ScUO.exe
%HOMEPATH%\gOEYMkgs\BMke.exe
%HOMEPATH%\gOEYMkgs\GAcE.exe
%HOMEPATH%\gOEYMkgs\NIIS.exe
%HOMEPATH%\gOEYMkgs\JEwG.exe
%HOMEPATH%\gOEYMkgs\akMU.exe
%HOMEPATH%\gOEYMkgs\zkUy.exe
%HOMEPATH%\gOEYMkgs\LoUc.exe
%HOMEPATH%\gOEYMkgs\NYcu.exe
%HOMEPATH%\gOEYMkgs\tooa.exe
%HOMEPATH%\gOEYMkgs\PcEw.exe
%HOMEPATH%\gOEYMkgs\LMkY.exe
%HOMEPATH%\gOEYMkgs\oMko.exe
%HOMEPATH%\gOEYMkgs\TEUa.exe
%HOMEPATH%\gOEYMkgs\SYQm.exe
%HOMEPATH%\gOEYMkgs\uIsI.exe
%HOMEPATH%\gOEYMkgs\AYsI.exe
%HOMEPATH%\gOEYMkgs\GQsG.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\GckO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\kcUO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%HOMEPATH%\gOEYMkgs\vEYU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\fswQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\XkwY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\eUMc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\xAgw.exe
%HOMEPATH%\gOEYMkgs\hUYe.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\lkky.exe
%HOMEPATH%\gOEYMkgs\psYE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\zMMa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\XIEI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\gwES.exe
%TEMP%\WERbcec.dir00\appcompat.txt
%TEMP%\WERbcec.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WERbcec.dir00\ZgMYMIIE.exe.mdmp
%TEMP%\WER2a51.dir00\ZgMYMIIE.exe.mdmp
<Текущая директория>\<Имя файла>
%TEMP%\WERbcec.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%TEMP%\WER2a51.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER980f.dir00\appcompat.txt
%TEMP%\WER980f.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER980f.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\GQIs.exe
%TEMP%\WER980f.dir00\manifest.txt
%TEMP%\WER21b0.dir00\ZgMYMIIE.exe.mdmp
%TEMP%\WER2a51.dir00\manifest.txt
%TEMP%\WER2a51.dir00\appcompat.txt
%TEMP%\WER21b0.dir00\manifest.txt
%TEMP%\WER21b0.dir00\appcompat.txt
%TEMP%\WER21b0.dir00\ZgMYMIIE.exe.hdmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\ckEU.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\ksYs.exe
%HOMEPATH%\gOEYMkgs\dwYa.exe
%HOMEPATH%\gOEYMkgs\ukwM.exe
%HOMEPATH%\gOEYMkgs\tEUG.exe
%HOMEPATH%\gOEYMkgs\scow.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\jgAA.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\pAAo.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%HOMEPATH%\gOEYMkgs\TMEg.exe
%HOMEPATH%\gOEYMkgs\FIEk.exe
%HOMEPATH%\gOEYMkgs\MoMq.exe
%HOMEPATH%\gOEYMkgs\iEYs.exe
%HOMEPATH%\gOEYMkgs\wMEi.exe
%HOMEPATH%\gOEYMkgs\zMoo.exe
%HOMEPATH%\gOEYMkgs\DUIS.exe
%HOMEPATH%\gOEYMkgs\ggwE.exe
%HOMEPATH%\gOEYMkgs\Dkck.exe
%HOMEPATH%\gOEYMkgs\qgIo.exe
%HOMEPATH%\gOEYMkgs\ekkM.exe
%HOMEPATH%\gOEYMkgs\pwwu.exe
%HOMEPATH%\gOEYMkgs\jEIM.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\iwki.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\nEQA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%HOMEPATH%\gOEYMkgs\TsMM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\CcgU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\AUsQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\iMUg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\hgwy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%HOMEPATH%\gOEYMkgs\wUAm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\vEEU.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\nkcI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\BAwe.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\MEUE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\sAgc.exe

Удаляет следующие файлы:

%HOMEPATH%\gOEYMkgs\BMke.exe
%HOMEPATH%\gOEYMkgs\kAcM.exe
%HOMEPATH%\gOEYMkgs\bgws.exe
%HOMEPATH%\gOEYMkgs\ScUO.exe
%HOMEPATH%\gOEYMkgs\ogAG.exe
%HOMEPATH%\gOEYMkgs\CAco.exe
%HOMEPATH%\gOEYMkgs\Okwm.exe
%HOMEPATH%\gOEYMkgs\Agcy.exe
%HOMEPATH%\gOEYMkgs\QUwO.exe
%HOMEPATH%\gOEYMkgs\DAUY.exe
%HOMEPATH%\gOEYMkgs\oAsC.exe
%HOMEPATH%\gOEYMkgs\OkAC.exe
%HOMEPATH%\gOEYMkgs\coYM.exe
%HOMEPATH%\gOEYMkgs\Mkgs.exe
%HOMEPATH%\gOEYMkgs\NIIS.exe
%HOMEPATH%\gOEYMkgs\JEwG.exe
%HOMEPATH%\gOEYMkgs\XsYM.exe
%HOMEPATH%\gOEYMkgs\GAcE.exe
%HOMEPATH%\gOEYMkgs\xAEa.exe
%HOMEPATH%\gOEYMkgs\QEkk.exe
%HOMEPATH%\gOEYMkgs\hMgy.exe
%HOMEPATH%\gOEYMkgs\DUkQ.exe
%HOMEPATH%\gOEYMkgs\GwsW.exe
%HOMEPATH%\gOEYMkgs\DYYc.exe
%HOMEPATH%\gOEYMkgs\SYUg.exe
%HOMEPATH%\gOEYMkgs\DQoi.exe
%HOMEPATH%\gOEYMkgs\HYoY.exe
%HOMEPATH%\gOEYMkgs\hsMY.exe
%HOMEPATH%\gOEYMkgs\agso.exe
%HOMEPATH%\gOEYMkgs\psUI.exe
%HOMEPATH%\gOEYMkgs\icII.exe
%HOMEPATH%\gOEYMkgs\askO.exe
%HOMEPATH%\gOEYMkgs\hEco.exe
%HOMEPATH%\gOEYMkgs\dYcm.exe
%HOMEPATH%\gOEYMkgs\ngEW.exe
%HOMEPATH%\gOEYMkgs\pMEM.exe
%HOMEPATH%\gOEYMkgs\VAEc.exe
%HOMEPATH%\gOEYMkgs\akMU.exe
%HOMEPATH%\gOEYMkgs\ZcIk.exe
%HOMEPATH%\gOEYMkgs\OYco.exe
%HOMEPATH%\gOEYMkgs\tQQo.exe
%HOMEPATH%\gOEYMkgs\Wcsc.exe
%HOMEPATH%\gOEYMkgs\mEEM.exe
%HOMEPATH%\gOEYMkgs\JQIe.exe
%HOMEPATH%\gOEYMkgs\OYAm.exe
%HOMEPATH%\gOEYMkgs\aYQi.exe
%HOMEPATH%\gOEYMkgs\twgI.exe
%HOMEPATH%\gOEYMkgs\LgYe.exe
%HOMEPATH%\gOEYMkgs\ywQC.exe
%HOMEPATH%\gOEYMkgs\VAoe.exe
%HOMEPATH%\gOEYMkgs\zYoK.exe
%HOMEPATH%\gOEYMkgs\OEQO.exe
%HOMEPATH%\gOEYMkgs\HkUk.exe
%HOMEPATH%\gOEYMkgs\HAcq.exe
%HOMEPATH%\gOEYMkgs\XQIC.exe
%HOMEPATH%\gOEYMkgs\SsoU.exe
%HOMEPATH%\gOEYMkgs\DoYo.exe
%HOMEPATH%\gOEYMkgs\NYcu.exe
%HOMEPATH%\gOEYMkgs\uIsI.exe
%HOMEPATH%\gOEYMkgs\zkUy.exe
%HOMEPATH%\gOEYMkgs\LoUc.exe
%HOMEPATH%\gOEYMkgs\AYsI.exe
%HOMEPATH%\gOEYMkgs\TEUa.exe
%HOMEPATH%\gOEYMkgs\SYQm.exe
%HOMEPATH%\gOEYMkgs\GQsG.exe
%HOMEPATH%\gOEYMkgs\oMko.exe
%HOMEPATH%\gOEYMkgs\cUom.exe
%HOMEPATH%\gOEYMkgs\dEUq.exe
%HOMEPATH%\gOEYMkgs\xcIa.exe
%HOMEPATH%\gOEYMkgs\hIUM.exe
%HOMEPATH%\gOEYMkgs\LYMq.exe
%HOMEPATH%\gOEYMkgs\PcEw.exe
%HOMEPATH%\gOEYMkgs\LMkY.exe
%HOMEPATH%\gOEYMkgs\mcIi.exe
%HOMEPATH%\gOEYMkgs\tooa.exe
%HOMEPATH%\gOEYMkgs\SIoe.exe
%HOMEPATH%\gOEYMkgs\wUAm.exe
%HOMEPATH%\gOEYMkgs\MEUE.exe
%HOMEPATH%\gOEYMkgs\vEEU.exe
%HOMEPATH%\gOEYMkgs\nkcI.exe
%HOMEPATH%\gOEYMkgs\sAgc.exe
%HOMEPATH%\gOEYMkgs\TsMM.exe
%HOMEPATH%\gOEYMkgs\iwki.exe
%HOMEPATH%\gOEYMkgs\BAwe.exe
%HOMEPATH%\gOEYMkgs\hgwy.exe
%HOMEPATH%\gOEYMkgs\ukwM.exe
%HOMEPATH%\gOEYMkgs\tEUG.exe
%HOMEPATH%\gOEYMkgs\TMEg.exe
%HOMEPATH%\gOEYMkgs\dwYa.exe
%HOMEPATH%\gOEYMkgs\ckEU.exe
%HOMEPATH%\gOEYMkgs\scow.exe
%HOMEPATH%\gOEYMkgs\jgAA.exe
%HOMEPATH%\gOEYMkgs\ksYs.exe
%HOMEPATH%\gOEYMkgs\pAAo.exe
%HOMEPATH%\gOEYMkgs\nEQA.exe
%HOMEPATH%\gOEYMkgs\GckO.exe
%HOMEPATH%\gOEYMkgs\XkwY.exe
%HOMEPATH%\gOEYMkgs\kcUO.exe
%HOMEPATH%\gOEYMkgs\vEYU.exe
%HOMEPATH%\gOEYMkgs\eUMc.exe
%HOMEPATH%\gOEYMkgs\GQIs.exe
%TEMP%\ggggAwcM.bat
%HOMEPATH%\gOEYMkgs\fswQ.exe
%HOMEPATH%\gOEYMkgs\gwES.exe
%HOMEPATH%\gOEYMkgs\AUsQ.exe
%HOMEPATH%\gOEYMkgs\hUYe.exe
%HOMEPATH%\gOEYMkgs\iMUg.exe
%HOMEPATH%\gOEYMkgs\CcgU.exe
%HOMEPATH%\gOEYMkgs\lkky.exe
%HOMEPATH%\gOEYMkgs\psYE.exe
%HOMEPATH%\gOEYMkgs\zMMa.exe
%HOMEPATH%\gOEYMkgs\xAgw.exe
%HOMEPATH%\gOEYMkgs\XIEI.exe
%HOMEPATH%\gOEYMkgs\qgIo.exe
%HOMEPATH%\gOEYMkgs\SQcQ.exe
%HOMEPATH%\gOEYMkgs\XcoK.exe
%HOMEPATH%\gOEYMkgs\ekQS.exe
%HOMEPATH%\gOEYMkgs\TMEi.exe
%HOMEPATH%\gOEYMkgs\zQEI.exe
%HOMEPATH%\gOEYMkgs\YsIs.exe
%HOMEPATH%\gOEYMkgs\XQoO.exe
%HOMEPATH%\gOEYMkgs\gEUA.exe
%HOMEPATH%\gOEYMkgs\VccK.exe
%HOMEPATH%\gOEYMkgs\BIMa.exe
%HOMEPATH%\gOEYMkgs\MMQO.exe
%HOMEPATH%\gOEYMkgs\yEAE.exe
%HOMEPATH%\gOEYMkgs\gkQk.exe
%HOMEPATH%\gOEYMkgs\gQYk.exe
%HOMEPATH%\gOEYMkgs\tQMc.exe
%HOMEPATH%\gOEYMkgs\JsQg.exe
%HOMEPATH%\gOEYMkgs\xYoM.exe
%HOMEPATH%\gOEYMkgs\lAAu.exe
%HOMEPATH%\gOEYMkgs\sMka.exe
%HOMEPATH%\gOEYMkgs\MoMq.exe
%HOMEPATH%\gOEYMkgs\iEYs.exe
%HOMEPATH%\gOEYMkgs\DUIS.exe
%HOMEPATH%\gOEYMkgs\FIEk.exe
%HOMEPATH%\gOEYMkgs\ekkM.exe
%HOMEPATH%\gOEYMkgs\ggwE.exe
%HOMEPATH%\gOEYMkgs\Dkck.exe
%HOMEPATH%\gOEYMkgs\pwwu.exe
%HOMEPATH%\gOEYMkgs\jEIM.exe
%HOMEPATH%\gOEYMkgs\DAUI.exe
%HOMEPATH%\gOEYMkgs\ZAAO.exe
%HOMEPATH%\gOEYMkgs\bwIs.exe
%HOMEPATH%\gOEYMkgs\hkMI.exe
%HOMEPATH%\gOEYMkgs\xQca.exe
%HOMEPATH%\gOEYMkgs\wMEi.exe
%HOMEPATH%\gOEYMkgs\zMoo.exe
%HOMEPATH%\gOEYMkgs\lMgk.exe
%HOMEPATH%\gOEYMkgs\LIEA.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'74.##5.232.51':80

TCP:

Запросы HTTP GET:

http://google.com/ via 74.##5.232.51
http:/// via 74.##5.232.51

UDP:

DNS ASK google.com

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'SSIkQYgQ.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней