Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
- <STUBS_DIR>\test.exe
- C:\Far2\Far.exe
- скрытых файлов
- расширений файлов
- Средство контроля пользовательских учетных записей (UAC)
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- %HOMEPATH%\gOEYMkgs\TAYk.exe
- %HOMEPATH%\gOEYMkgs\ckQI.exe
- %HOMEPATH%\gOEYMkgs\yEUw.exe
- %HOMEPATH%\gOEYMkgs\CosC.exe
- %HOMEPATH%\gOEYMkgs\NYsc.exe
- %HOMEPATH%\gOEYMkgs\Twga.exe
- %HOMEPATH%\gOEYMkgs\TgUy.exe
- %HOMEPATH%\gOEYMkgs\kowc.exe
- %HOMEPATH%\gOEYMkgs\uwIu.exe
- %HOMEPATH%\gOEYMkgs\Kksi.exe
- %HOMEPATH%\gOEYMkgs\nsUK.exe
- %HOMEPATH%\gOEYMkgs\IoAQ.exe
- %HOMEPATH%\gOEYMkgs\rYQa.exe
- %HOMEPATH%\gOEYMkgs\ggsS.exe
- %HOMEPATH%\gOEYMkgs\mUcM.exe
- %HOMEPATH%\gOEYMkgs\MwEI.exe
- %HOMEPATH%\gOEYMkgs\aYwm.exe
- %HOMEPATH%\gOEYMkgs\RgYu.exe
- %HOMEPATH%\gOEYMkgs\AgEk.exe
- %HOMEPATH%\gOEYMkgs\Akky.exe
- %HOMEPATH%\gOEYMkgs\eMQs.exe
- %HOMEPATH%\gOEYMkgs\iAgi.exe
- %HOMEPATH%\gOEYMkgs\zIgu.exe
- %HOMEPATH%\gOEYMkgs\AwIW.exe
- %HOMEPATH%\gOEYMkgs\GAwG.exe
- %HOMEPATH%\gOEYMkgs\HEYS.exe
- %HOMEPATH%\gOEYMkgs\boMK.exe
- %HOMEPATH%\gOEYMkgs\JkYQ.exe
- %HOMEPATH%\gOEYMkgs\XIIC.exe
- %HOMEPATH%\gOEYMkgs\Qgwm.exe
- %HOMEPATH%\gOEYMkgs\JYAA.exe
- %HOMEPATH%\gOEYMkgs\DYMe.exe
- %HOMEPATH%\gOEYMkgs\FIQA.exe
- %HOMEPATH%\gOEYMkgs\vsUC.exe
- %HOMEPATH%\gOEYMkgs\UQQa.exe
- %HOMEPATH%\gOEYMkgs\HMkg.exe
- %HOMEPATH%\gOEYMkgs\pMUe.exe
- %HOMEPATH%\gOEYMkgs\CYsc.exe
- %HOMEPATH%\gOEYMkgs\oQEs.exe
- %HOMEPATH%\gOEYMkgs\WYIo.exe
- %HOMEPATH%\gOEYMkgs\fUgU.exe
- %HOMEPATH%\gOEYMkgs\FIYg.exe
- %HOMEPATH%\gOEYMkgs\zAwY.exe
- %HOMEPATH%\gOEYMkgs\dgMm.exe
- %HOMEPATH%\gOEYMkgs\PwsE.exe
- %HOMEPATH%\gOEYMkgs\uAoW.exe
- %HOMEPATH%\gOEYMkgs\nQoc.exe
- %HOMEPATH%\gOEYMkgs\QYIC.exe
- %HOMEPATH%\gOEYMkgs\KYsW.exe
- %HOMEPATH%\gOEYMkgs\zAoI.exe
- %HOMEPATH%\gOEYMkgs\IAYQ.exe
- %HOMEPATH%\gOEYMkgs\aoAc.exe
- %HOMEPATH%\gOEYMkgs\fcUg.exe
- %HOMEPATH%\gOEYMkgs\VEsK.exe
- %HOMEPATH%\gOEYMkgs\ZEYE.exe
- %HOMEPATH%\gOEYMkgs\rUoe.exe
- %HOMEPATH%\gOEYMkgs\VAIe.exe
- %HOMEPATH%\gOEYMkgs\zEYu.exe
- %HOMEPATH%\gOEYMkgs\zYki.exe
- %HOMEPATH%\gOEYMkgs\Ggwo.exe
- %HOMEPATH%\gOEYMkgs\Vwcs.exe
- %HOMEPATH%\gOEYMkgs\Mwcc.exe
- %HOMEPATH%\gOEYMkgs\lEUY.exe
- %HOMEPATH%\gOEYMkgs\fgYs.exe
- %HOMEPATH%\gOEYMkgs\fsIg.exe
- %HOMEPATH%\gOEYMkgs\ZQAO.exe
- %HOMEPATH%\gOEYMkgs\UcUw.exe
- %HOMEPATH%\gOEYMkgs\iwoa.exe
- %HOMEPATH%\gOEYMkgs\oMUE.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
- %HOMEPATH%\gOEYMkgs\CIgi.exe
- %HOMEPATH%\gOEYMkgs\MAQA.exe
- %HOMEPATH%\gOEYMkgs\HIYy.exe
- %HOMEPATH%\gOEYMkgs\xEAA.exe
- %HOMEPATH%\gOEYMkgs\jcwU.exe
- %HOMEPATH%\gOEYMkgs\JcUo.exe
- %HOMEPATH%\gOEYMkgs\igMI.exe
- %HOMEPATH%\gOEYMkgs\QAgw.exe
- %HOMEPATH%\gOEYMkgs\OIwy.exe
- %HOMEPATH%\gOEYMkgs\EYIy.exe
- %HOMEPATH%\gOEYMkgs\Wcgu.exe
- %HOMEPATH%\gOEYMkgs\uQcK.exe
- %HOMEPATH%\gOEYMkgs\TEUu.exe
- %HOMEPATH%\gOEYMkgs\BIoa.exe
- %HOMEPATH%\gOEYMkgs\yIoC.exe
- %HOMEPATH%\gOEYMkgs\Sgcg.exe
- %HOMEPATH%\gOEYMkgs\lIEw.exe
- %HOMEPATH%\gOEYMkgs\Iokw.exe
- %HOMEPATH%\gOEYMkgs\Eowg.exe
- %HOMEPATH%\gOEYMkgs\xcwy.exe
- %HOMEPATH%\gOEYMkgs\Kcww.exe
- %HOMEPATH%\gOEYMkgs\NYAA.exe
- %HOMEPATH%\gOEYMkgs\IUsS.exe
- %HOMEPATH%\gOEYMkgs\vcAg.exe
- C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
- %HOMEPATH%\gOEYMkgs\coIo.exe
- %HOMEPATH%\gOEYMkgs\WwMA.exe
- %HOMEPATH%\gOEYMkgs\AUMI.exe
- %HOMEPATH%\gOEYMkgs\dEAi.exe
- %HOMEPATH%\gOEYMkgs\iEcU.exe
- %HOMEPATH%\gOEYMkgs\TgEm.exe
- %HOMEPATH%\gOEYMkgs\boIe.exe
- %HOMEPATH%\gOEYMkgs\nYku.exe
- %HOMEPATH%\gOEYMkgs\WMYS.exe
- %HOMEPATH%\gOEYMkgs\CEUe.exe
- %HOMEPATH%\gOEYMkgs\YQwo.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %HOMEPATH%\gOEYMkgs\Wgkq.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %HOMEPATH%\gOEYMkgs\YEYG.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %HOMEPATH%\gOEYMkgs\hMIm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %HOMEPATH%\gOEYMkgs\HQwc.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %HOMEPATH%\gOEYMkgs\ZEEC.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %HOMEPATH%\gOEYMkgs\YswK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %HOMEPATH%\gOEYMkgs\oMcQ.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %HOMEPATH%\gOEYMkgs\JgAw.exe
- %HOMEPATH%\gOEYMkgs\YQkA.exe
- %HOMEPATH%\gOEYMkgs\icMo.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %HOMEPATH%\gOEYMkgs\WkcY.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %HOMEPATH%\gOEYMkgs\KQMu.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %TEMP%\WER938d.dir00\manifest.txt
- %TEMP%\WER938d.dir00\appcompat.txt
- %TEMP%\WER938d.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER0bb3.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER0bb3.dir00\ZgMYMIIE.exe.mdmp
- <Текущая директория>\<Имя файла>
- %ALLUSERSPROFILE%\caQc.txt
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %TEMP%\WER938d.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %TEMP%\WERfe6c.dir00\manifest.txt
- %TEMP%\WERfe6c.dir00\appcompat.txt
- %TEMP%\WERfe6c.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\moYK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %HOMEPATH%\gOEYMkgs\JAcS.exe
- %TEMP%\WERfe6c.dir00\ZgMYMIIE.exe.mdmp
- %TEMP%\WER8289.dir00\ZgMYMIIE.exe.mdmp
- %TEMP%\WER0bb3.dir00\manifest.txt
- %TEMP%\WER0bb3.dir00\appcompat.txt
- %TEMP%\WER8289.dir00\manifest.txt
- %TEMP%\WER8289.dir00\appcompat.txt
- %TEMP%\WER8289.dir00\ZgMYMIIE.exe.hdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %HOMEPATH%\gOEYMkgs\msMw.exe
- %HOMEPATH%\gOEYMkgs\PYMI.exe
- %HOMEPATH%\gOEYMkgs\TIMK.exe
- %HOMEPATH%\gOEYMkgs\ecQc.exe
- %HOMEPATH%\gOEYMkgs\AgkG.exe
- %HOMEPATH%\gOEYMkgs\lAAM.exe
- %HOMEPATH%\gOEYMkgs\fMoo.exe
- %HOMEPATH%\gOEYMkgs\tUMe.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %HOMEPATH%\gOEYMkgs\QEAs.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %HOMEPATH%\gOEYMkgs\XIMY.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %TEMP%\WER9a03.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\XgMe.exe
- %HOMEPATH%\gOEYMkgs\Zkkc.exe
- %HOMEPATH%\gOEYMkgs\ecks.exe
- %HOMEPATH%\gOEYMkgs\XYwG.exe
- %TEMP%\WER9a03.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\FUkU.exe
- %HOMEPATH%\gOEYMkgs\UIEI.exe
- %HOMEPATH%\gOEYMkgs\fwYA.exe
- %TEMP%\WER9a03.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\WoUG.exe
- %TEMP%\WER9a03.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\AUYm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\YMgO.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %HOMEPATH%\gOEYMkgs\iQwk.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\pAkS.exe
- %HOMEPATH%\gOEYMkgs\rooQ.exe
- %HOMEPATH%\gOEYMkgs\WEYu.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %HOMEPATH%\gOEYMkgs\UIIo.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %HOMEPATH%\gOEYMkgs\SgEe.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %HOMEPATH%\gOEYMkgs\ossQ.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %HOMEPATH%\gOEYMkgs\IwQC.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %HOMEPATH%\gOEYMkgs\kIkI.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %HOMEPATH%\gOEYMkgs\OUYm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %HOMEPATH%\gOEYMkgs\iAMi.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\VwAc.exe
- %HOMEPATH%\gOEYMkgs\xcwy.exe
- %HOMEPATH%\gOEYMkgs\Kcww.exe
- %HOMEPATH%\gOEYMkgs\uQcK.exe
- %HOMEPATH%\gOEYMkgs\Sgcg.exe
- %HOMEPATH%\gOEYMkgs\NYAA.exe
- %HOMEPATH%\gOEYMkgs\Eowg.exe
- %HOMEPATH%\gOEYMkgs\fcUg.exe
- %HOMEPATH%\gOEYMkgs\lIEw.exe
- %HOMEPATH%\gOEYMkgs\Iokw.exe
- %HOMEPATH%\gOEYMkgs\Wcgu.exe
- %HOMEPATH%\gOEYMkgs\iEcU.exe
- %HOMEPATH%\gOEYMkgs\TgEm.exe
- %HOMEPATH%\gOEYMkgs\WMYS.exe
- %HOMEPATH%\gOEYMkgs\CEUe.exe
- %HOMEPATH%\gOEYMkgs\boIe.exe
- %HOMEPATH%\gOEYMkgs\yIoC.exe
- %HOMEPATH%\gOEYMkgs\EYIy.exe
- %HOMEPATH%\gOEYMkgs\TEUu.exe
- %HOMEPATH%\gOEYMkgs\BIoa.exe
- %HOMEPATH%\gOEYMkgs\aYwm.exe
- %HOMEPATH%\gOEYMkgs\CosC.exe
- %HOMEPATH%\gOEYMkgs\NYsc.exe
- %HOMEPATH%\gOEYMkgs\iAgi.exe
- %HOMEPATH%\gOEYMkgs\zIgu.exe
- %HOMEPATH%\gOEYMkgs\Twga.exe
- %HOMEPATH%\gOEYMkgs\yEUw.exe
- %HOMEPATH%\gOEYMkgs\TgUy.exe
- %HOMEPATH%\gOEYMkgs\TAYk.exe
- %HOMEPATH%\gOEYMkgs\ckQI.exe
- %HOMEPATH%\gOEYMkgs\eMQs.exe
- %HOMEPATH%\gOEYMkgs\ggsS.exe
- %HOMEPATH%\gOEYMkgs\mUcM.exe
- %HOMEPATH%\gOEYMkgs\RgYu.exe
- %HOMEPATH%\gOEYMkgs\AgEk.exe
- %HOMEPATH%\gOEYMkgs\MwEI.exe
- %HOMEPATH%\gOEYMkgs\GAwG.exe
- %HOMEPATH%\gOEYMkgs\HEYS.exe
- %HOMEPATH%\gOEYMkgs\Akky.exe
- %HOMEPATH%\gOEYMkgs\AwIW.exe
- %HOMEPATH%\gOEYMkgs\nYku.exe
- %HOMEPATH%\gOEYMkgs\oMUE.exe
- %HOMEPATH%\gOEYMkgs\HIYy.exe
- %HOMEPATH%\gOEYMkgs\UcUw.exe
- %HOMEPATH%\gOEYMkgs\iwoa.exe
- %HOMEPATH%\gOEYMkgs\igMI.exe
- %HOMEPATH%\gOEYMkgs\xEAA.exe
- %HOMEPATH%\gOEYMkgs\jcwU.exe
- %HOMEPATH%\gOEYMkgs\QAgw.exe
- %HOMEPATH%\gOEYMkgs\OIwy.exe
- %HOMEPATH%\gOEYMkgs\MAQA.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize
- %HOMEPATH%\gOEYMkgs\CIgi.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log
- %HOMEPATH%\gOEYMkgs\JcUo.exe
- %HOMEPATH%\gOEYMkgs\lEUY.exe
- %HOMEPATH%\gOEYMkgs\coIo.exe
- %HOMEPATH%\gOEYMkgs\Vwcs.exe
- %HOMEPATH%\gOEYMkgs\Mwcc.exe
- %HOMEPATH%\gOEYMkgs\WwMA.exe
- %HOMEPATH%\gOEYMkgs\vcAg.exe
- %HOMEPATH%\gOEYMkgs\dEAi.exe
- %HOMEPATH%\gOEYMkgs\AUMI.exe
- %HOMEPATH%\gOEYMkgs\IUsS.exe
- %HOMEPATH%\gOEYMkgs\ZQAO.exe
- %HOMEPATH%\gOEYMkgs\zYki.exe
- %HOMEPATH%\gOEYMkgs\VEsK.exe
- %HOMEPATH%\gOEYMkgs\VAIe.exe
- %HOMEPATH%\gOEYMkgs\zEYu.exe
- %HOMEPATH%\gOEYMkgs\ZEYE.exe
- %HOMEPATH%\gOEYMkgs\fgYs.exe
- %HOMEPATH%\gOEYMkgs\fsIg.exe
- %HOMEPATH%\gOEYMkgs\rUoe.exe
- %HOMEPATH%\gOEYMkgs\Ggwo.exe
- %HOMEPATH%\gOEYMkgs\nsUK.exe
- %HOMEPATH%\gOEYMkgs\IwQC.exe
- %HOMEPATH%\gOEYMkgs\iAMi.exe
- %HOMEPATH%\gOEYMkgs\kIkI.exe
- %HOMEPATH%\gOEYMkgs\ossQ.exe
- %HOMEPATH%\gOEYMkgs\VwAc.exe
- %HOMEPATH%\gOEYMkgs\pAkS.exe
- %HOMEPATH%\gOEYMkgs\YMgO.exe
- %HOMEPATH%\gOEYMkgs\OUYm.exe
- %HOMEPATH%\gOEYMkgs\iQwk.exe
- %HOMEPATH%\gOEYMkgs\QEAs.exe
- %HOMEPATH%\gOEYMkgs\lAAM.exe
- %HOMEPATH%\gOEYMkgs\msMw.exe
- %HOMEPATH%\gOEYMkgs\ecQc.exe
- %HOMEPATH%\gOEYMkgs\AgkG.exe
- %HOMEPATH%\gOEYMkgs\PYMI.exe
- %HOMEPATH%\gOEYMkgs\XIMY.exe
- %HOMEPATH%\gOEYMkgs\tUMe.exe
- %HOMEPATH%\gOEYMkgs\TIMK.exe
- %HOMEPATH%\gOEYMkgs\fMoo.exe
- %HOMEPATH%\gOEYMkgs\rooQ.exe
- %HOMEPATH%\gOEYMkgs\Wgkq.exe
- %HOMEPATH%\gOEYMkgs\HQwc.exe
- %HOMEPATH%\gOEYMkgs\YEYG.exe
- %HOMEPATH%\gOEYMkgs\YQwo.exe
- %HOMEPATH%\gOEYMkgs\ZEEC.exe
- %HOMEPATH%\gOEYMkgs\JAcS.exe
- %TEMP%\amQAQsoQ.bat
- %HOMEPATH%\gOEYMkgs\hMIm.exe
- %HOMEPATH%\gOEYMkgs\moYK.exe
- %HOMEPATH%\gOEYMkgs\WkcY.exe
- %HOMEPATH%\gOEYMkgs\UIIo.exe
- %HOMEPATH%\gOEYMkgs\oMcQ.exe
- %HOMEPATH%\gOEYMkgs\SgEe.exe
- %HOMEPATH%\gOEYMkgs\WEYu.exe
- %HOMEPATH%\gOEYMkgs\JgAw.exe
- %HOMEPATH%\gOEYMkgs\KQMu.exe
- %HOMEPATH%\gOEYMkgs\icMo.exe
- %HOMEPATH%\gOEYMkgs\YswK.exe
- %HOMEPATH%\gOEYMkgs\YQkA.exe
- %HOMEPATH%\gOEYMkgs\fwYA.exe
- %HOMEPATH%\gOEYMkgs\zAoI.exe
- %HOMEPATH%\gOEYMkgs\IAYQ.exe
- %HOMEPATH%\gOEYMkgs\FIYg.exe
- %HOMEPATH%\gOEYMkgs\uAoW.exe
- %HOMEPATH%\gOEYMkgs\aoAc.exe
- %HOMEPATH%\gOEYMkgs\KYsW.exe
- %HOMEPATH%\gOEYMkgs\Qgwm.exe
- %HOMEPATH%\gOEYMkgs\nQoc.exe
- %HOMEPATH%\gOEYMkgs\QYIC.exe
- %HOMEPATH%\gOEYMkgs\fUgU.exe
- %HOMEPATH%\gOEYMkgs\kowc.exe
- %HOMEPATH%\gOEYMkgs\uwIu.exe
- %HOMEPATH%\gOEYMkgs\IoAQ.exe
- %HOMEPATH%\gOEYMkgs\rYQa.exe
- %HOMEPATH%\gOEYMkgs\Kksi.exe
- %HOMEPATH%\gOEYMkgs\PwsE.exe
- %HOMEPATH%\gOEYMkgs\WYIo.exe
- %HOMEPATH%\gOEYMkgs\zAwY.exe
- %HOMEPATH%\gOEYMkgs\dgMm.exe
- %HOMEPATH%\gOEYMkgs\JYAA.exe
- %HOMEPATH%\gOEYMkgs\XYwG.exe
- %HOMEPATH%\gOEYMkgs\XgMe.exe
- %HOMEPATH%\gOEYMkgs\HMkg.exe
- %HOMEPATH%\gOEYMkgs\ecks.exe
- %HOMEPATH%\gOEYMkgs\Zkkc.exe
- %HOMEPATH%\gOEYMkgs\AUYm.exe
- %HOMEPATH%\gOEYMkgs\UIEI.exe
- %HOMEPATH%\gOEYMkgs\FUkU.exe
- %HOMEPATH%\gOEYMkgs\WoUG.exe
- %HOMEPATH%\gOEYMkgs\UQQa.exe
- %HOMEPATH%\gOEYMkgs\JkYQ.exe
- %HOMEPATH%\gOEYMkgs\XIIC.exe
- %HOMEPATH%\gOEYMkgs\DYMe.exe
- %HOMEPATH%\gOEYMkgs\boMK.exe
- %HOMEPATH%\gOEYMkgs\FIQA.exe
- %HOMEPATH%\gOEYMkgs\oQEs.exe
- %HOMEPATH%\gOEYMkgs\vsUC.exe
- %HOMEPATH%\gOEYMkgs\pMUe.exe
- %HOMEPATH%\gOEYMkgs\CYsc.exe
- '74.##5.232.51':80
- http://google.com/ via 74.##5.232.51
- http:/// via 74.##5.232.51
- DNS ASK google.com
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'lacMcYws.exe'