Trojan.MulDrop7.36298

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Заражает следующие исполняемые файлы:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Запускает на исполнение:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cmd.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\WER3064.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\sAIm.exe
%TEMP%\WER3064.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\WwkW.exe
%HOMEPATH%\gOEYMkgs\NcUc.exe
%HOMEPATH%\gOEYMkgs\YwUU.exe
%HOMEPATH%\gOEYMkgs\wMsC.exe
%TEMP%\WER3064.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\FMwK.exe
%HOMEPATH%\gOEYMkgs\askC.exe
%HOMEPATH%\gOEYMkgs\ZwgI.exe
%HOMEPATH%\gOEYMkgs\fcQS.exe
%HOMEPATH%\gOEYMkgs\usoc.exe
%HOMEPATH%\gOEYMkgs\XIQg.exe
%HOMEPATH%\gOEYMkgs\osQa.exe
%HOMEPATH%\gOEYMkgs\zMko.exe
%HOMEPATH%\gOEYMkgs\tcsy.exe
%HOMEPATH%\gOEYMkgs\uYMI.exe
%HOMEPATH%\gOEYMkgs\WgMM.exe
%HOMEPATH%\gOEYMkgs\jIcM.exe
%HOMEPATH%\gOEYMkgs\Psou.exe
%HOMEPATH%\gOEYMkgs\HQku.exe
%HOMEPATH%\gOEYMkgs\PoUy.exe
%HOMEPATH%\gOEYMkgs\oAMs.exe
%HOMEPATH%\gOEYMkgs\wcQw.exe
%HOMEPATH%\gOEYMkgs\jcUg.exe
%HOMEPATH%\gOEYMkgs\pYMs.exe
%HOMEPATH%\gOEYMkgs\BsMA.exe
%HOMEPATH%\gOEYMkgs\hgQq.exe
%HOMEPATH%\gOEYMkgs\yEMw.exe
%HOMEPATH%\gOEYMkgs\pckg.exe
%HOMEPATH%\gOEYMkgs\xkMQ.exe
%HOMEPATH%\gOEYMkgs\fYEa.exe
%HOMEPATH%\gOEYMkgs\cowU.exe
%HOMEPATH%\gOEYMkgs\vIMw.exe
%HOMEPATH%\gOEYMkgs\MAoY.exe
%HOMEPATH%\gOEYMkgs\HgsG.exe
%HOMEPATH%\gOEYMkgs\OoUy.exe
%HOMEPATH%\gOEYMkgs\BQwa.exe
%HOMEPATH%\gOEYMkgs\qgoM.exe
%HOMEPATH%\gOEYMkgs\pswg.exe
%HOMEPATH%\gOEYMkgs\oQEc.exe
%HOMEPATH%\gOEYMkgs\ZcYW.exe
%TEMP%\WER3064.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\wEME.exe
%HOMEPATH%\gOEYMkgs\yIcs.exe
%HOMEPATH%\gOEYMkgs\bsQu.exe
%HOMEPATH%\gOEYMkgs\joMY.exe
%HOMEPATH%\gOEYMkgs\IwQk.exe
%HOMEPATH%\gOEYMkgs\RMwc.exe
%HOMEPATH%\gOEYMkgs\QgUg.exe
%HOMEPATH%\gOEYMkgs\bIEs.exe
%HOMEPATH%\gOEYMkgs\nwQc.exe
%HOMEPATH%\gOEYMkgs\XMoa.exe
%HOMEPATH%\gOEYMkgs\Jgkm.exe
%HOMEPATH%\gOEYMkgs\IsYg.exe
%HOMEPATH%\gOEYMkgs\zksk.exe
%HOMEPATH%\gOEYMkgs\UsIQ.exe
%HOMEPATH%\gOEYMkgs\CkwO.exe
%HOMEPATH%\gOEYMkgs\xgsG.exe
%HOMEPATH%\gOEYMkgs\vUIk.exe
%HOMEPATH%\gOEYMkgs\WAwU.exe
%HOMEPATH%\gOEYMkgs\NAcM.exe
%HOMEPATH%\gOEYMkgs\mgUe.exe
%HOMEPATH%\gOEYMkgs\KsQk.exe
%HOMEPATH%\gOEYMkgs\Nwog.exe
%TEMP%\WERa863.dir00\manifest.txt
%TEMP%\WERa863.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\HoII.exe
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
%HOMEPATH%\gOEYMkgs\Mscy.exe
%HOMEPATH%\gOEYMkgs\hAwc.exe
%HOMEPATH%\gOEYMkgs\tYQw.exe
%HOMEPATH%\gOEYMkgs\gwoe.exe
%TEMP%\WERa863.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\IMUy.exe
%HOMEPATH%\gOEYMkgs\wMoy.exe
%TEMP%\WERa863.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\BYwW.exe
%HOMEPATH%\gOEYMkgs\EUEE.exe
%HOMEPATH%\gOEYMkgs\ogUi.exe
%HOMEPATH%\gOEYMkgs\vUoC.exe
%HOMEPATH%\gOEYMkgs\kMQO.exe
%HOMEPATH%\gOEYMkgs\rQgs.exe
%HOMEPATH%\gOEYMkgs\Esos.exe
%HOMEPATH%\gOEYMkgs\NcwO.exe
%HOMEPATH%\gOEYMkgs\FgQw.exe
%HOMEPATH%\gOEYMkgs\dgUg.exe
%HOMEPATH%\gOEYMkgs\nkYU.exe
%HOMEPATH%\gOEYMkgs\AEUw.exe
%HOMEPATH%\gOEYMkgs\LUEI.exe
%HOMEPATH%\gOEYMkgs\rIwC.exe
%HOMEPATH%\gOEYMkgs\uUwC.exe
%HOMEPATH%\gOEYMkgs\scIG.exe
%HOMEPATH%\gOEYMkgs\cUgi.exe
%HOMEPATH%\gOEYMkgs\TQkY.exe
%HOMEPATH%\gOEYMkgs\yokg.exe
%HOMEPATH%\gOEYMkgs\NMsa.exe
%HOMEPATH%\gOEYMkgs\gUkK.exe
%HOMEPATH%\gOEYMkgs\LAsC.exe
%HOMEPATH%\gOEYMkgs\BgAu.exe
%HOMEPATH%\gOEYMkgs\zoIM.exe
%HOMEPATH%\gOEYMkgs\bIwc.exe
%HOMEPATH%\gOEYMkgs\gAAG.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\MYUK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\KAIs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\Bosa.exe
%HOMEPATH%\gOEYMkgs\FYgS.exe
%HOMEPATH%\gOEYMkgs\KIYg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\jUIk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\cwUU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\zUMk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\JwQK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\dIQm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\egkO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\eUoW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\iYoK.exe
%TEMP%\WERcab7.dir00\manifest.txt
%TEMP%\WERcab7.dir00\appcompat.txt
%TEMP%\WERcab7.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\LYkE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\bkMK.exe
%TEMP%\WERcab7.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\CAQu.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\coMk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%HOMEPATH%\gOEYMkgs\FUgi.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\EwkK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\vQYc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\FYQW.exe
%HOMEPATH%\gOEYMkgs\eAUM.exe
%HOMEPATH%\gOEYMkgs\sUYm.exe
%HOMEPATH%\gOEYMkgs\AYYS.exe
%HOMEPATH%\gOEYMkgs\VUQq.exe
%HOMEPATH%\gOEYMkgs\LQIC.exe
%HOMEPATH%\gOEYMkgs\BUkW.exe
%HOMEPATH%\gOEYMkgs\QUIa.exe
%HOMEPATH%\gOEYMkgs\GAgI.exe
%HOMEPATH%\gOEYMkgs\GUUU.exe
%HOMEPATH%\gOEYMkgs\SoAa.exe
%HOMEPATH%\gOEYMkgs\pYEu.exe
%HOMEPATH%\gOEYMkgs\kkMi.exe
%HOMEPATH%\gOEYMkgs\mkUe.exe
%HOMEPATH%\gOEYMkgs\XAsy.exe
%TEMP%\WERbf09.dir00\manifest.txt
%TEMP%\WERbf09.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\MwIi.exe
%HOMEPATH%\gOEYMkgs\ygoe.exe
%HOMEPATH%\gOEYMkgs\uIUO.exe
%HOMEPATH%\gOEYMkgs\rIoU.exe
%HOMEPATH%\gOEYMkgs\DosK.exe
%TEMP%\WERbf09.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\LAse.exe
%HOMEPATH%\gOEYMkgs\JIMk.exe
%HOMEPATH%\gOEYMkgs\jIYG.exe
%TEMP%\WERbf09.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\bcog.exe
%HOMEPATH%\gOEYMkgs\xcUW.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\FUgQ.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\ssws.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\QgMS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\qUYm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\qwkU.exe
%HOMEPATH%\gOEYMkgs\DAgC.exe
%TEMP%\WER4eff.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER4eff.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\tMoU.exe
%TEMP%\WER4eff.dir00\manifest.txt
%TEMP%\WER4eff.dir00\appcompat.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\aIUU.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%HOMEPATH%\gOEYMkgs\cgkK.exe
%HOMEPATH%\gOEYMkgs\DcMS.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
<Текущая директория>\<Имя файла>

Удаляет следующие файлы:

%HOMEPATH%\gOEYMkgs\FgQw.exe
%HOMEPATH%\gOEYMkgs\dgUg.exe
%HOMEPATH%\gOEYMkgs\LUEI.exe
%HOMEPATH%\gOEYMkgs\NcwO.exe
%HOMEPATH%\gOEYMkgs\nwQc.exe
%HOMEPATH%\gOEYMkgs\WgMM.exe
%HOMEPATH%\gOEYMkgs\XIQg.exe
%HOMEPATH%\gOEYMkgs\tcsy.exe
%HOMEPATH%\gOEYMkgs\uYMI.exe
%HOMEPATH%\gOEYMkgs\AEUw.exe
%HOMEPATH%\gOEYMkgs\kMQO.exe
%HOMEPATH%\gOEYMkgs\rQgs.exe
%HOMEPATH%\gOEYMkgs\BgAu.exe
%HOMEPATH%\gOEYMkgs\vUoC.exe
%HOMEPATH%\gOEYMkgs\BYwW.exe
%HOMEPATH%\gOEYMkgs\Esos.exe
%HOMEPATH%\gOEYMkgs\nkYU.exe
%HOMEPATH%\gOEYMkgs\EUEE.exe
%HOMEPATH%\gOEYMkgs\ogUi.exe
%HOMEPATH%\gOEYMkgs\osQa.exe
%HOMEPATH%\gOEYMkgs\wMsC.exe
%HOMEPATH%\gOEYMkgs\ZwgI.exe
%HOMEPATH%\gOEYMkgs\YwUU.exe
%HOMEPATH%\gOEYMkgs\sAIm.exe
%HOMEPATH%\gOEYMkgs\fcQS.exe
%HOMEPATH%\gOEYMkgs\askC.exe
%HOMEPATH%\gOEYMkgs\ZcYW.exe
%HOMEPATH%\gOEYMkgs\usoc.exe
%HOMEPATH%\gOEYMkgs\FMwK.exe
%HOMEPATH%\gOEYMkgs\NcUc.exe
%HOMEPATH%\gOEYMkgs\oAMs.exe
%HOMEPATH%\gOEYMkgs\wcQw.exe
%HOMEPATH%\gOEYMkgs\zMko.exe
%HOMEPATH%\gOEYMkgs\jIcM.exe
%HOMEPATH%\gOEYMkgs\jcUg.exe
%HOMEPATH%\gOEYMkgs\PoUy.exe
%HOMEPATH%\gOEYMkgs\WwkW.exe
%HOMEPATH%\gOEYMkgs\Psou.exe
%HOMEPATH%\gOEYMkgs\HQku.exe
%HOMEPATH%\gOEYMkgs\LAsC.exe
%HOMEPATH%\gOEYMkgs\wMoy.exe
%HOMEPATH%\gOEYMkgs\tYQw.exe
%HOMEPATH%\gOEYMkgs\hAwc.exe
%HOMEPATH%\gOEYMkgs\IMUy.exe
%HOMEPATH%\gOEYMkgs\gwoe.exe
%HOMEPATH%\gOEYMkgs\CkwO.exe
%HOMEPATH%\gOEYMkgs\XMoa.exe
%HOMEPATH%\gOEYMkgs\zksk.exe
%HOMEPATH%\gOEYMkgs\UsIQ.exe
%HOMEPATH%\gOEYMkgs\HoII.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize
%HOMEPATH%\gOEYMkgs\Mscy.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log
%HOMEPATH%\gOEYMkgs\Jgkm.exe
%HOMEPATH%\gOEYMkgs\uUwC.exe
%HOMEPATH%\gOEYMkgs\scIG.exe
%HOMEPATH%\gOEYMkgs\yokg.exe
%HOMEPATH%\gOEYMkgs\rIwC.exe
%HOMEPATH%\gOEYMkgs\NMsa.exe
%HOMEPATH%\gOEYMkgs\gAAG.exe
%HOMEPATH%\gOEYMkgs\gUkK.exe
%HOMEPATH%\gOEYMkgs\zoIM.exe
%HOMEPATH%\gOEYMkgs\bIwc.exe
%HOMEPATH%\gOEYMkgs\TQkY.exe
%HOMEPATH%\gOEYMkgs\mgUe.exe
%HOMEPATH%\gOEYMkgs\KsQk.exe
%HOMEPATH%\gOEYMkgs\IsYg.exe
%HOMEPATH%\gOEYMkgs\xgsG.exe
%HOMEPATH%\gOEYMkgs\Nwog.exe
%HOMEPATH%\gOEYMkgs\NAcM.exe
%HOMEPATH%\gOEYMkgs\cUgi.exe
%HOMEPATH%\gOEYMkgs\vUIk.exe
%HOMEPATH%\gOEYMkgs\WAwU.exe
%HOMEPATH%\gOEYMkgs\wEME.exe
%HOMEPATH%\gOEYMkgs\xcUW.exe
%HOMEPATH%\gOEYMkgs\FUgQ.exe
%HOMEPATH%\gOEYMkgs\cgkK.exe
%HOMEPATH%\gOEYMkgs\ssws.exe
%HOMEPATH%\gOEYMkgs\qUYm.exe
%HOMEPATH%\gOEYMkgs\eAUM.exe
%HOMEPATH%\gOEYMkgs\dIQm.exe
%HOMEPATH%\gOEYMkgs\qwkU.exe
%HOMEPATH%\gOEYMkgs\QgMS.exe
%HOMEPATH%\gOEYMkgs\aIUU.exe
%HOMEPATH%\gOEYMkgs\GUUU.exe
%HOMEPATH%\gOEYMkgs\SoAa.exe
%HOMEPATH%\gOEYMkgs\mkUe.exe
%HOMEPATH%\gOEYMkgs\XAsy.exe
%HOMEPATH%\gOEYMkgs\pYEu.exe
%HOMEPATH%\gOEYMkgs\DcMS.exe
%TEMP%\WAcsEIcA.bat
%HOMEPATH%\gOEYMkgs\tMoU.exe
%HOMEPATH%\gOEYMkgs\DAgC.exe
%HOMEPATH%\gOEYMkgs\zUMk.exe
%HOMEPATH%\gOEYMkgs\CAQu.exe
%HOMEPATH%\gOEYMkgs\coMk.exe
%HOMEPATH%\gOEYMkgs\jUIk.exe
%HOMEPATH%\gOEYMkgs\FUgi.exe
%HOMEPATH%\gOEYMkgs\vQYc.exe
%HOMEPATH%\gOEYMkgs\LYkE.exe
%HOMEPATH%\gOEYMkgs\bkMK.exe
%HOMEPATH%\gOEYMkgs\FYQW.exe
%HOMEPATH%\gOEYMkgs\EwkK.exe
%HOMEPATH%\gOEYMkgs\KIYg.exe
%HOMEPATH%\gOEYMkgs\iYoK.exe
%HOMEPATH%\gOEYMkgs\egkO.exe
%HOMEPATH%\gOEYMkgs\JwQK.exe
%HOMEPATH%\gOEYMkgs\eUoW.exe
%HOMEPATH%\gOEYMkgs\KAIs.exe
%HOMEPATH%\gOEYMkgs\FYgS.exe
%HOMEPATH%\gOEYMkgs\cwUU.exe
%HOMEPATH%\gOEYMkgs\Bosa.exe
%HOMEPATH%\gOEYMkgs\MYUK.exe
%HOMEPATH%\gOEYMkgs\kkMi.exe
%HOMEPATH%\gOEYMkgs\xkMQ.exe
%HOMEPATH%\gOEYMkgs\pYMs.exe
%HOMEPATH%\gOEYMkgs\yEMw.exe
%HOMEPATH%\gOEYMkgs\pckg.exe
%HOMEPATH%\gOEYMkgs\BsMA.exe
%HOMEPATH%\gOEYMkgs\HgsG.exe
%HOMEPATH%\gOEYMkgs\OoUy.exe
%HOMEPATH%\gOEYMkgs\hgQq.exe
%HOMEPATH%\gOEYMkgs\fYEa.exe
%HOMEPATH%\gOEYMkgs\IwQk.exe
%HOMEPATH%\gOEYMkgs\oQEc.exe
%HOMEPATH%\gOEYMkgs\yIcs.exe
%HOMEPATH%\gOEYMkgs\qgoM.exe
%HOMEPATH%\gOEYMkgs\pswg.exe
%HOMEPATH%\gOEYMkgs\RMwc.exe
%HOMEPATH%\gOEYMkgs\bsQu.exe
%HOMEPATH%\gOEYMkgs\joMY.exe
%HOMEPATH%\gOEYMkgs\QgUg.exe
%HOMEPATH%\gOEYMkgs\bIEs.exe
%HOMEPATH%\gOEYMkgs\BQwa.exe
%HOMEPATH%\gOEYMkgs\LQIC.exe
%HOMEPATH%\gOEYMkgs\BUkW.exe
%HOMEPATH%\gOEYMkgs\LAse.exe
%HOMEPATH%\gOEYMkgs\JIMk.exe
%HOMEPATH%\gOEYMkgs\QUIa.exe
%HOMEPATH%\gOEYMkgs\VUQq.exe
%HOMEPATH%\gOEYMkgs\GAgI.exe
%HOMEPATH%\gOEYMkgs\sUYm.exe
%HOMEPATH%\gOEYMkgs\AYYS.exe
%HOMEPATH%\gOEYMkgs\bcog.exe
%HOMEPATH%\gOEYMkgs\MAoY.exe
%HOMEPATH%\gOEYMkgs\ygoe.exe
%HOMEPATH%\gOEYMkgs\cowU.exe
%HOMEPATH%\gOEYMkgs\vIMw.exe
%HOMEPATH%\gOEYMkgs\uIUO.exe
%HOMEPATH%\gOEYMkgs\DosK.exe
%HOMEPATH%\gOEYMkgs\jIYG.exe
%HOMEPATH%\gOEYMkgs\rIoU.exe
%HOMEPATH%\gOEYMkgs\MwIi.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'74.##5.232.51':443
'ap#.###coincharts.com':443
'74.##5.232.51':80

TCP:

Запросы HTTP GET:

http:/// via 74.##5.232.51
http://google.com/ via 74.##5.232.51

UDP:

DNS ASK ma##.google.com
DNS ASK ap#.###coincharts.com
DNS ASK google.com

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'Run'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: '' WindowName: 'Open'
ClassName: 'WorkerW' WindowName: ''
ClassName: 'DV2ControlHost' WindowName: ''
ClassName: 'BUTTON' WindowName: 'START'
ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'xSMgIcIg'
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Windows Internet Explorer'
ClassName: '' WindowName: 'Open File'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней