Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
Заражает следующие исполняемые файлы:
- <STUBS_DIR>\test.exe
- C:\Far2\Far.exe
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
- расширений файлов
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\gOEYMkgs\PgAO.exe
- %HOMEPATH%\gOEYMkgs\oYIA.exe
- %HOMEPATH%\gOEYMkgs\UEwa.exe
- %HOMEPATH%\gOEYMkgs\MMsi.exe
- %HOMEPATH%\gOEYMkgs\JEQc.exe
- %HOMEPATH%\gOEYMkgs\TEgM.exe
- %HOMEPATH%\gOEYMkgs\WkEC.exe
- %HOMEPATH%\gOEYMkgs\RwAq.exe
- %HOMEPATH%\gOEYMkgs\HYok.exe
- %HOMEPATH%\gOEYMkgs\CgsA.exe
- %HOMEPATH%\gOEYMkgs\bAsa.exe
- %HOMEPATH%\gOEYMkgs\vsAw.exe
- %HOMEPATH%\gOEYMkgs\xgMe.exe
- %HOMEPATH%\gOEYMkgs\OYMe.exe
- %HOMEPATH%\gOEYMkgs\RgYi.exe
- %HOMEPATH%\gOEYMkgs\jYkU.exe
- %HOMEPATH%\gOEYMkgs\kQYM.exe
- %HOMEPATH%\gOEYMkgs\akow.exe
- %HOMEPATH%\gOEYMkgs\OQsU.exe
- %HOMEPATH%\gOEYMkgs\JMoq.exe
- %HOMEPATH%\gOEYMkgs\IIog.exe
- %HOMEPATH%\gOEYMkgs\vwEq.exe
- %HOMEPATH%\gOEYMkgs\FsYc.exe
- %HOMEPATH%\gOEYMkgs\MQUK.exe
- %HOMEPATH%\gOEYMkgs\QQcc.exe
- %TEMP%\WER558a.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\yAMg.exe
- %HOMEPATH%\gOEYMkgs\hIMs.exe
- %HOMEPATH%\gOEYMkgs\pAwW.exe
- %HOMEPATH%\gOEYMkgs\Nows.exe
- %HOMEPATH%\gOEYMkgs\ZUEk.exe
- %HOMEPATH%\gOEYMkgs\OwIg.exe
- %HOMEPATH%\gOEYMkgs\AskI.exe
- %HOMEPATH%\gOEYMkgs\AIwU.exe
- %HOMEPATH%\gOEYMkgs\jYsU.exe
- %HOMEPATH%\gOEYMkgs\oEgM.exe
- %TEMP%\WER558a.dir00\appcompat.txt
- %TEMP%\WER558a.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\qAYU.exe
- %HOMEPATH%\gOEYMkgs\zAAk.exe
- %HOMEPATH%\gOEYMkgs\lgAE.exe
- %HOMEPATH%\gOEYMkgs\fUQm.exe
- %HOMEPATH%\gOEYMkgs\egYa.exe
- %HOMEPATH%\gOEYMkgs\KAcg.exe
- %HOMEPATH%\gOEYMkgs\JYEW.exe
- %TEMP%\WER558a.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\Bcck.exe
- %HOMEPATH%\gOEYMkgs\EMkw.exe
- %HOMEPATH%\gOEYMkgs\YAge.exe
- %HOMEPATH%\gOEYMkgs\Ckwc.exe
- %HOMEPATH%\gOEYMkgs\kcsQ.exe
- %HOMEPATH%\gOEYMkgs\GMEc.exe
- %HOMEPATH%\gOEYMkgs\GkMC.exe
- %HOMEPATH%\gOEYMkgs\uAcw.exe
- %HOMEPATH%\gOEYMkgs\AgUC.exe
- %HOMEPATH%\gOEYMkgs\WQIe.exe
- %HOMEPATH%\gOEYMkgs\dAAk.exe
- %HOMEPATH%\gOEYMkgs\msoW.exe
- %HOMEPATH%\gOEYMkgs\vIMs.exe
- %HOMEPATH%\gOEYMkgs\vwAk.exe
- %TEMP%\WERcc32.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\JYEi.exe
- %HOMEPATH%\gOEYMkgs\Lsca.exe
- %HOMEPATH%\gOEYMkgs\wkMq.exe
- %HOMEPATH%\gOEYMkgs\VsQW.exe
- %HOMEPATH%\gOEYMkgs\VEsk.exe
- %HOMEPATH%\gOEYMkgs\FUAi.exe
- %HOMEPATH%\gOEYMkgs\psMA.exe
- %HOMEPATH%\gOEYMkgs\fsAO.exe
- %HOMEPATH%\gOEYMkgs\zUoM.exe
- %HOMEPATH%\gOEYMkgs\bcoM.exe
- %HOMEPATH%\gOEYMkgs\NooC.exe
- %HOMEPATH%\gOEYMkgs\dQIS.exe
- %HOMEPATH%\gOEYMkgs\cAwY.exe
- %HOMEPATH%\gOEYMkgs\LAIq.exe
- %HOMEPATH%\gOEYMkgs\mEkK.exe
- %HOMEPATH%\gOEYMkgs\OYca.exe
- %HOMEPATH%\gOEYMkgs\LYcc.exe
- %HOMEPATH%\gOEYMkgs\CQIi.exe
- %HOMEPATH%\gOEYMkgs\owYC.exe
- %HOMEPATH%\gOEYMkgs\TAsY.exe
- %HOMEPATH%\gOEYMkgs\JkUE.exe
- %HOMEPATH%\gOEYMkgs\KwAq.exe
- %HOMEPATH%\gOEYMkgs\tMIO.exe
- %HOMEPATH%\gOEYMkgs\MwUk.exe
- %HOMEPATH%\gOEYMkgs\cwgO.exe
- %HOMEPATH%\gOEYMkgs\pUwq.exe
- %HOMEPATH%\gOEYMkgs\icgm.exe
- %HOMEPATH%\gOEYMkgs\CgEO.exe
- %HOMEPATH%\gOEYMkgs\KQQY.exe
- %HOMEPATH%\gOEYMkgs\xIsY.exe
- %HOMEPATH%\gOEYMkgs\KsQo.exe
- %HOMEPATH%\gOEYMkgs\TEcQ.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %HOMEPATH%\gOEYMkgs\jUgA.exe
- %HOMEPATH%\gOEYMkgs\Bggw.exe
- %HOMEPATH%\gOEYMkgs\TMks.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- <Текущая директория>\<Имя файла>
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %HOMEPATH%\gOEYMkgs\tMwQ.exe
- %HOMEPATH%\gOEYMkgs\ioIC.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %HOMEPATH%\gOEYMkgs\wkUa.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %HOMEPATH%\gOEYMkgs\PEYI.exe
- %HOMEPATH%\gOEYMkgs\DMoW.exe
- %HOMEPATH%\gOEYMkgs\SAYe.exe
- %TEMP%\WERda00.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %HOMEPATH%\gOEYMkgs\RoQe.exe
- %TEMP%\WER62ae.dir00\appcompat.txt
- %TEMP%\WER62ae.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER62ae.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\hIEQ.exe
- %ALLUSERSPROFILE%\caQc.txt
- %TEMP%\WER62ae.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %HOMEPATH%\gOEYMkgs\ZIkI.exe
- %HOMEPATH%\gOEYMkgs\GYAq.exe
- %HOMEPATH%\gOEYMkgs\doge.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %HOMEPATH%\gOEYMkgs\YQsK.exe
- %HOMEPATH%\gOEYMkgs\ckgu.exe
- %HOMEPATH%\gOEYMkgs\LkUw.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %HOMEPATH%\gOEYMkgs\GIsu.exe
- %HOMEPATH%\gOEYMkgs\tMYO.exe
- %HOMEPATH%\gOEYMkgs\IkMQ.exe
- %HOMEPATH%\gOEYMkgs\OQES.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %HOMEPATH%\gOEYMkgs\mgUk.exe
- %HOMEPATH%\gOEYMkgs\FAIU.exe
- %HOMEPATH%\gOEYMkgs\UsMM.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %HOMEPATH%\gOEYMkgs\iEog.exe
- %HOMEPATH%\gOEYMkgs\YEki.exe
- %HOMEPATH%\gOEYMkgs\AkkQ.exe
- %HOMEPATH%\gOEYMkgs\tUEG.exe
- %HOMEPATH%\gOEYMkgs\cgIu.exe
- %HOMEPATH%\gOEYMkgs\bkEm.exe
- %HOMEPATH%\gOEYMkgs\fQUC.exe
- %HOMEPATH%\gOEYMkgs\GwYc.exe
- %HOMEPATH%\gOEYMkgs\aQoU.exe
- %HOMEPATH%\gOEYMkgs\EoMA.exe
- %HOMEPATH%\gOEYMkgs\ewIQ.exe
- %HOMEPATH%\gOEYMkgs\isgy.exe
- %TEMP%\WERda00.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\vwQk.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\TQYS.exe
- %TEMP%\WERda00.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\nswm.exe
- %TEMP%\WERda00.dir00\ZgMYMIIE.exe.hdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %HOMEPATH%\gOEYMkgs\awkO.exe
- %HOMEPATH%\gOEYMkgs\PwoQ.exe
- %HOMEPATH%\gOEYMkgs\REwk.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %HOMEPATH%\gOEYMkgs\TYkw.exe
- %HOMEPATH%\gOEYMkgs\oYEw.exe
- %HOMEPATH%\gOEYMkgs\KQIs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\Qskk.exe
Удаляет следующие файлы:
- %HOMEPATH%\gOEYMkgs\jYkU.exe
- %HOMEPATH%\gOEYMkgs\kQYM.exe
- %HOMEPATH%\gOEYMkgs\mEkK.exe
- %HOMEPATH%\gOEYMkgs\OYca.exe
- %HOMEPATH%\gOEYMkgs\OYMe.exe
- %HOMEPATH%\gOEYMkgs\akow.exe
- %HOMEPATH%\gOEYMkgs\RgYi.exe
- %HOMEPATH%\gOEYMkgs\xgMe.exe
- %HOMEPATH%\gOEYMkgs\zUoM.exe
- %HOMEPATH%\gOEYMkgs\bcoM.exe
- %HOMEPATH%\gOEYMkgs\cAwY.exe
- %HOMEPATH%\gOEYMkgs\NooC.exe
- %HOMEPATH%\gOEYMkgs\owYC.exe
- %HOMEPATH%\gOEYMkgs\LYcc.exe
- %HOMEPATH%\gOEYMkgs\LAIq.exe
- %HOMEPATH%\gOEYMkgs\CQIi.exe
- %HOMEPATH%\gOEYMkgs\vwEq.exe
- %HOMEPATH%\gOEYMkgs\TEgM.exe
- %HOMEPATH%\gOEYMkgs\CgsA.exe
- %HOMEPATH%\gOEYMkgs\PgAO.exe
- %HOMEPATH%\gOEYMkgs\oYIA.exe
- %HOMEPATH%\gOEYMkgs\WkEC.exe
- %HOMEPATH%\gOEYMkgs\RwAq.exe
- %HOMEPATH%\gOEYMkgs\bAsa.exe
- %HOMEPATH%\gOEYMkgs\HYok.exe
- %HOMEPATH%\gOEYMkgs\OQsU.exe
- %HOMEPATH%\gOEYMkgs\JMoq.exe
- %HOMEPATH%\gOEYMkgs\FsYc.exe
- %HOMEPATH%\gOEYMkgs\IIog.exe
- %HOMEPATH%\gOEYMkgs\JEQc.exe
- %HOMEPATH%\gOEYMkgs\UEwa.exe
- %HOMEPATH%\gOEYMkgs\vsAw.exe
- %HOMEPATH%\gOEYMkgs\MMsi.exe
- %HOMEPATH%\gOEYMkgs\dQIS.exe
- %HOMEPATH%\gOEYMkgs\Ckwc.exe
- %HOMEPATH%\gOEYMkgs\kcsQ.exe
- %HOMEPATH%\gOEYMkgs\VEsk.exe
- %HOMEPATH%\gOEYMkgs\msoW.exe
- %HOMEPATH%\gOEYMkgs\EMkw.exe
- %HOMEPATH%\gOEYMkgs\GMEc.exe
- %HOMEPATH%\gOEYMkgs\YAge.exe
- %HOMEPATH%\gOEYMkgs\Bcck.exe
- %HOMEPATH%\gOEYMkgs\vwAk.exe
- %HOMEPATH%\gOEYMkgs\wkMq.exe
- %HOMEPATH%\gOEYMkgs\Lsca.exe
- %HOMEPATH%\gOEYMkgs\vIMs.exe
- %HOMEPATH%\gOEYMkgs\FUAi.exe
- %HOMEPATH%\gOEYMkgs\VsQW.exe
- %HOMEPATH%\gOEYMkgs\psMA.exe
- %HOMEPATH%\gOEYMkgs\fsAO.exe
- %HOMEPATH%\gOEYMkgs\WQIe.exe
- %HOMEPATH%\gOEYMkgs\xIsY.exe
- %HOMEPATH%\gOEYMkgs\KsQo.exe
- %HOMEPATH%\gOEYMkgs\KwAq.exe
- %HOMEPATH%\gOEYMkgs\pUwq.exe
- %HOMEPATH%\gOEYMkgs\CgEO.exe
- %HOMEPATH%\gOEYMkgs\TAsY.exe
- %HOMEPATH%\gOEYMkgs\KQQY.exe
- %HOMEPATH%\gOEYMkgs\icgm.exe
- %HOMEPATH%\gOEYMkgs\GkMC.exe
- %HOMEPATH%\gOEYMkgs\uAcw.exe
- %HOMEPATH%\gOEYMkgs\dAAk.exe
- %HOMEPATH%\gOEYMkgs\AgUC.exe
- %HOMEPATH%\gOEYMkgs\tMIO.exe
- %HOMEPATH%\gOEYMkgs\JkUE.exe
- %HOMEPATH%\gOEYMkgs\MwUk.exe
- %HOMEPATH%\gOEYMkgs\cwgO.exe
- %HOMEPATH%\gOEYMkgs\PwoQ.exe
- %HOMEPATH%\gOEYMkgs\TQYS.exe
- %HOMEPATH%\gOEYMkgs\Qskk.exe
- %HOMEPATH%\gOEYMkgs\KQIs.exe
- %HOMEPATH%\gOEYMkgs\nswm.exe
- %HOMEPATH%\gOEYMkgs\PEYI.exe
- %HOMEPATH%\gOEYMkgs\vwQk.exe
- %HOMEPATH%\gOEYMkgs\awkO.exe
- %HOMEPATH%\gOEYMkgs\UsMM.exe
- %HOMEPATH%\gOEYMkgs\FAIU.exe
- %HOMEPATH%\gOEYMkgs\tMYO.exe
- %HOMEPATH%\gOEYMkgs\GIsu.exe
- %HOMEPATH%\gOEYMkgs\REwk.exe
- %HOMEPATH%\gOEYMkgs\oYEw.exe
- %HOMEPATH%\gOEYMkgs\mgUk.exe
- %HOMEPATH%\gOEYMkgs\TYkw.exe
- %HOMEPATH%\gOEYMkgs\wkUa.exe
- %HOMEPATH%\gOEYMkgs\GYAq.exe
- %HOMEPATH%\gOEYMkgs\ZIkI.exe
- %TEMP%\ZGooUgkc.bat
- %HOMEPATH%\gOEYMkgs\doge.exe
- %HOMEPATH%\gOEYMkgs\YQsK.exe
- %HOMEPATH%\gOEYMkgs\hIEQ.exe
- %HOMEPATH%\gOEYMkgs\LkUw.exe
- %HOMEPATH%\gOEYMkgs\ckgu.exe
- %HOMEPATH%\gOEYMkgs\SAYe.exe
- %HOMEPATH%\gOEYMkgs\TMks.exe
- %HOMEPATH%\gOEYMkgs\DMoW.exe
- %HOMEPATH%\gOEYMkgs\RoQe.exe
- %HOMEPATH%\gOEYMkgs\ioIC.exe
- %HOMEPATH%\gOEYMkgs\tMwQ.exe
- %HOMEPATH%\gOEYMkgs\Bggw.exe
- %HOMEPATH%\gOEYMkgs\jUgA.exe
- %HOMEPATH%\gOEYMkgs\OQES.exe
- %HOMEPATH%\gOEYMkgs\hIMs.exe
- %HOMEPATH%\gOEYMkgs\MQUK.exe
- %HOMEPATH%\gOEYMkgs\jYsU.exe
- %HOMEPATH%\gOEYMkgs\yAMg.exe
- %HOMEPATH%\gOEYMkgs\AskI.exe
- %HOMEPATH%\gOEYMkgs\AIwU.exe
- %HOMEPATH%\gOEYMkgs\QQcc.exe
- %HOMEPATH%\gOEYMkgs\pAwW.exe
- %HOMEPATH%\gOEYMkgs\oEgM.exe
- %HOMEPATH%\gOEYMkgs\lgAE.exe
- %HOMEPATH%\gOEYMkgs\qAYU.exe
- %HOMEPATH%\gOEYMkgs\zAAk.exe
- %HOMEPATH%\gOEYMkgs\fUQm.exe
- %HOMEPATH%\gOEYMkgs\egYa.exe
- %HOMEPATH%\gOEYMkgs\JYEW.exe
- %HOMEPATH%\gOEYMkgs\KAcg.exe
- %HOMEPATH%\gOEYMkgs\OwIg.exe
- %HOMEPATH%\gOEYMkgs\isgy.exe
- %HOMEPATH%\gOEYMkgs\EoMA.exe
- %HOMEPATH%\gOEYMkgs\fQUC.exe
- %HOMEPATH%\gOEYMkgs\ewIQ.exe
- %HOMEPATH%\gOEYMkgs\iEog.exe
- %HOMEPATH%\gOEYMkgs\IkMQ.exe
- %HOMEPATH%\gOEYMkgs\GwYc.exe
- %HOMEPATH%\gOEYMkgs\aQoU.exe
- %HOMEPATH%\gOEYMkgs\TEcQ.exe
- %HOMEPATH%\gOEYMkgs\cgIu.exe
- %HOMEPATH%\gOEYMkgs\Nows.exe
- %HOMEPATH%\gOEYMkgs\ZUEk.exe
- %HOMEPATH%\gOEYMkgs\YEki.exe
- %HOMEPATH%\gOEYMkgs\AkkQ.exe
- %HOMEPATH%\gOEYMkgs\bkEm.exe
- %HOMEPATH%\gOEYMkgs\tUEG.exe
Сетевая активность:
Подключается к:
- '74.##5.232.51':80
TCP:
Запросы HTTP GET:
- http://google.com/ via 74.##5.232.51
- http:/// via 74.##5.232.51
UDP:
- DNS ASK google.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'lacMcYws.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
