Trojan.DownLoader25.18674

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Infects the following executable files:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Executes the following:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

Modifies file system:

Creates the following files:

%HOMEPATH%\gOEYMkgs\ioIi.exe
%HOMEPATH%\gOEYMkgs\oUcE.exe
%HOMEPATH%\gOEYMkgs\XwAc.exe
%HOMEPATH%\gOEYMkgs\DIQo.exe
%HOMEPATH%\gOEYMkgs\QIwa.exe
%HOMEPATH%\gOEYMkgs\MMIc.exe
%HOMEPATH%\gOEYMkgs\UIse.exe
%HOMEPATH%\gOEYMkgs\zUMU.exe
%HOMEPATH%\gOEYMkgs\CMwE.exe
%HOMEPATH%\gOEYMkgs\ykEM.exe
%HOMEPATH%\gOEYMkgs\MsIM.exe
%HOMEPATH%\gOEYMkgs\KgAi.exe
%HOMEPATH%\gOEYMkgs\gYIc.exe
%HOMEPATH%\gOEYMkgs\oYog.exe
%HOMEPATH%\gOEYMkgs\xkoC.exe
%HOMEPATH%\gOEYMkgs\KIYo.exe
%HOMEPATH%\gOEYMkgs\tQMK.exe
%HOMEPATH%\gOEYMkgs\oosC.exe
%HOMEPATH%\gOEYMkgs\HwEC.exe
%HOMEPATH%\gOEYMkgs\HscQ.exe
%HOMEPATH%\gOEYMkgs\FscE.exe
%HOMEPATH%\gOEYMkgs\DwcK.exe
%HOMEPATH%\gOEYMkgs\EgsA.exe
%HOMEPATH%\gOEYMkgs\uIkC.exe
%HOMEPATH%\gOEYMkgs\OsEc.exe
%HOMEPATH%\gOEYMkgs\PQoU.exe
%HOMEPATH%\gOEYMkgs\cIQG.exe
%HOMEPATH%\gOEYMkgs\vogY.exe
%HOMEPATH%\gOEYMkgs\isQk.exe
%HOMEPATH%\gOEYMkgs\QckI.exe
%HOMEPATH%\gOEYMkgs\eEEK.exe
%HOMEPATH%\gOEYMkgs\JcII.exe
%HOMEPATH%\gOEYMkgs\HIsY.exe
%HOMEPATH%\gOEYMkgs\gkwo.exe
%HOMEPATH%\gOEYMkgs\tgwW.exe
%HOMEPATH%\gOEYMkgs\TokC.exe
%HOMEPATH%\gOEYMkgs\jEkw.exe
%HOMEPATH%\gOEYMkgs\GIsK.exe
%HOMEPATH%\gOEYMkgs\dcUK.exe
%HOMEPATH%\gOEYMkgs\WAsA.exe
%HOMEPATH%\gOEYMkgs\rMgW.exe
%HOMEPATH%\gOEYMkgs\sAUm.exe
%HOMEPATH%\gOEYMkgs\ZUwm.exe
%HOMEPATH%\gOEYMkgs\HYMe.exe
%HOMEPATH%\gOEYMkgs\hoYm.exe
%HOMEPATH%\gOEYMkgs\oAgA.exe
%HOMEPATH%\gOEYMkgs\jIMg.exe
%HOMEPATH%\gOEYMkgs\ZwUi.exe
%HOMEPATH%\gOEYMkgs\NIEq.exe
%HOMEPATH%\gOEYMkgs\OMoy.exe
%HOMEPATH%\gOEYMkgs\AYUI.exe
%HOMEPATH%\gOEYMkgs\dcMW.exe
%HOMEPATH%\gOEYMkgs\ussy.exe
%HOMEPATH%\gOEYMkgs\rsYS.exe
%HOMEPATH%\gOEYMkgs\uoAU.exe
%HOMEPATH%\gOEYMkgs\WwMs.exe
%HOMEPATH%\gOEYMkgs\TMIU.exe
%HOMEPATH%\gOEYMkgs\EAIA.exe
%HOMEPATH%\gOEYMkgs\KcEq.exe
%HOMEPATH%\gOEYMkgs\gEsa.exe
%HOMEPATH%\gOEYMkgs\CQcI.exe
%HOMEPATH%\gOEYMkgs\CUEy.exe
%HOMEPATH%\gOEYMkgs\toYC.exe
%HOMEPATH%\gOEYMkgs\DMEq.exe
%HOMEPATH%\gOEYMkgs\Dsck.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
%HOMEPATH%\gOEYMkgs\pUEk.exe
%HOMEPATH%\gOEYMkgs\ywgU.exe
%HOMEPATH%\gOEYMkgs\zAgW.exe
%HOMEPATH%\gOEYMkgs\xQAA.exe
%HOMEPATH%\gOEYMkgs\boEY.exe
%HOMEPATH%\gOEYMkgs\TcEw.exe
%HOMEPATH%\gOEYMkgs\PcIM.exe
%HOMEPATH%\gOEYMkgs\lggC.exe
%HOMEPATH%\gOEYMkgs\tcwq.exe
%HOMEPATH%\gOEYMkgs\lIcC.exe
%HOMEPATH%\gOEYMkgs\LUIM.exe
%HOMEPATH%\gOEYMkgs\TAwg.exe
%HOMEPATH%\gOEYMkgs\wcMK.exe
%HOMEPATH%\gOEYMkgs\hkEA.exe
%HOMEPATH%\gOEYMkgs\QEYU.exe
%HOMEPATH%\gOEYMkgs\FEoW.exe
%HOMEPATH%\gOEYMkgs\mssa.exe
%HOMEPATH%\gOEYMkgs\rcUa.exe
%HOMEPATH%\gOEYMkgs\zAYE.exe
%HOMEPATH%\gOEYMkgs\esoY.exe
%HOMEPATH%\gOEYMkgs\VIcS.exe
%HOMEPATH%\gOEYMkgs\Rkcc.exe
%HOMEPATH%\gOEYMkgs\WYkG.exe
%HOMEPATH%\gOEYMkgs\poIG.exe
%HOMEPATH%\gOEYMkgs\wYIE.exe
%HOMEPATH%\gOEYMkgs\uQIk.exe
%HOMEPATH%\gOEYMkgs\hEsI.exe
%HOMEPATH%\gOEYMkgs\jkUy.exe
%HOMEPATH%\gOEYMkgs\UIQk.exe
%HOMEPATH%\gOEYMkgs\awUm.exe
%HOMEPATH%\gOEYMkgs\bsIE.exe
%HOMEPATH%\gOEYMkgs\QAky.exe
%HOMEPATH%\gOEYMkgs\UggA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\FscY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%HOMEPATH%\gOEYMkgs\GsIA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\pcYO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\iYcS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\zwYe.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%HOMEPATH%\gOEYMkgs\RcQI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\Zosw.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\tsgq.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\qgUo.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\qsog.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\GQgQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\nQMk.exe
%HOMEPATH%\gOEYMkgs\XEgA.exe
%TEMP%\WERd477.dir00\appcompat.txt
%TEMP%\WERd477.dir00\ZgMYMIIE.exe.hdmp
%ALLUSERSPROFILE%\caQc.txt
%TEMP%\WER4dd3.dir00\ZgMYMIIE.exe.mdmp
<Current directory>\<File name>
%TEMP%\WERd477.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%TEMP%\WERd477.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\tYEc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\sMgu.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\jUQg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%TEMP%\WER4dd3.dir00\manifest.txt
%TEMP%\WER4dd3.dir00\appcompat.txt
%TEMP%\WER4dd3.dir00\ZgMYMIIE.exe.hdmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\XUcM.exe
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\FoIU.exe
%HOMEPATH%\gOEYMkgs\ZgAy.exe
%HOMEPATH%\gOEYMkgs\iowO.exe
%HOMEPATH%\gOEYMkgs\poog.exe
%HOMEPATH%\gOEYMkgs\NwgK.exe
%HOMEPATH%\gOEYMkgs\Gcom.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\wEES.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\zQgw.exe
%HOMEPATH%\gOEYMkgs\GEkA.exe
%HOMEPATH%\gOEYMkgs\GAQi.exe
%HOMEPATH%\gOEYMkgs\DggO.exe
%HOMEPATH%\gOEYMkgs\mMwC.exe
%HOMEPATH%\gOEYMkgs\DIMQ.exe
%HOMEPATH%\gOEYMkgs\bcky.exe
%HOMEPATH%\gOEYMkgs\uIMA.exe
%HOMEPATH%\gOEYMkgs\lEAK.exe
%HOMEPATH%\gOEYMkgs\aIEm.exe
%HOMEPATH%\gOEYMkgs\eowW.exe
%HOMEPATH%\gOEYMkgs\MYIk.exe
%HOMEPATH%\gOEYMkgs\CIEu.exe
%HOMEPATH%\gOEYMkgs\rgkW.exe
%HOMEPATH%\gOEYMkgs\cwwY.exe
%HOMEPATH%\gOEYMkgs\asIw.exe
%HOMEPATH%\gOEYMkgs\JkMC.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\Tksa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\losu.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\VsEw.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\SsEW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%HOMEPATH%\gOEYMkgs\LYYS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\pEss.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\SQUc.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%HOMEPATH%\gOEYMkgs\WkIc.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\YgQs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\jYEk.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\BcYU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe

Deletes the following files:

%HOMEPATH%\gOEYMkgs\VIcS.exe
%HOMEPATH%\gOEYMkgs\FEoW.exe
%HOMEPATH%\gOEYMkgs\zAYE.exe
%HOMEPATH%\gOEYMkgs\esoY.exe
%HOMEPATH%\gOEYMkgs\mssa.exe
%HOMEPATH%\gOEYMkgs\KIYo.exe
%HOMEPATH%\gOEYMkgs\tQMK.exe
%HOMEPATH%\gOEYMkgs\rcUa.exe
%HOMEPATH%\gOEYMkgs\OMoy.exe
%HOMEPATH%\gOEYMkgs\TAwg.exe
%HOMEPATH%\gOEYMkgs\UIQk.exe
%HOMEPATH%\gOEYMkgs\awUm.exe
%HOMEPATH%\gOEYMkgs\UggA.exe
%HOMEPATH%\gOEYMkgs\jkUy.exe
%HOMEPATH%\gOEYMkgs\wcMK.exe
%HOMEPATH%\gOEYMkgs\lIcC.exe
%HOMEPATH%\gOEYMkgs\LUIM.exe
%HOMEPATH%\gOEYMkgs\hkEA.exe
%HOMEPATH%\gOEYMkgs\QEYU.exe
%HOMEPATH%\gOEYMkgs\oosC.exe
%HOMEPATH%\gOEYMkgs\ioIi.exe
%HOMEPATH%\gOEYMkgs\oUcE.exe
%HOMEPATH%\gOEYMkgs\QIwa.exe
%HOMEPATH%\gOEYMkgs\MMIc.exe
%HOMEPATH%\gOEYMkgs\XwAc.exe
%HOMEPATH%\gOEYMkgs\KgAi.exe
%HOMEPATH%\gOEYMkgs\UIse.exe
%HOMEPATH%\gOEYMkgs\ykEM.exe
%HOMEPATH%\gOEYMkgs\MsIM.exe
%HOMEPATH%\gOEYMkgs\DIQo.exe
%HOMEPATH%\gOEYMkgs\xkoC.exe
%HOMEPATH%\gOEYMkgs\DwcK.exe
%HOMEPATH%\gOEYMkgs\gYIc.exe
%HOMEPATH%\gOEYMkgs\oYog.exe
%HOMEPATH%\gOEYMkgs\EgsA.exe
%HOMEPATH%\gOEYMkgs\HscQ.exe
%HOMEPATH%\gOEYMkgs\FscE.exe
%HOMEPATH%\gOEYMkgs\uIkC.exe
%HOMEPATH%\gOEYMkgs\HwEC.exe
%HOMEPATH%\gOEYMkgs\QAky.exe
%HOMEPATH%\gOEYMkgs\Dsck.exe
%HOMEPATH%\gOEYMkgs\TcEw.exe
%HOMEPATH%\gOEYMkgs\toYC.exe
%HOMEPATH%\gOEYMkgs\DMEq.exe
%HOMEPATH%\gOEYMkgs\PcIM.exe
%HOMEPATH%\gOEYMkgs\xQAA.exe
%HOMEPATH%\gOEYMkgs\boEY.exe
%HOMEPATH%\gOEYMkgs\lggC.exe
%HOMEPATH%\gOEYMkgs\zAgW.exe
%HOMEPATH%\gOEYMkgs\ywgU.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize
%HOMEPATH%\gOEYMkgs\pUEk.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log
%HOMEPATH%\gOEYMkgs\rsYS.exe
%HOMEPATH%\gOEYMkgs\wYIE.exe
%HOMEPATH%\gOEYMkgs\uQIk.exe
%HOMEPATH%\gOEYMkgs\KcEq.exe
%HOMEPATH%\gOEYMkgs\tcwq.exe
%HOMEPATH%\gOEYMkgs\hEsI.exe
%HOMEPATH%\gOEYMkgs\poIG.exe
%HOMEPATH%\gOEYMkgs\bsIE.exe
%HOMEPATH%\gOEYMkgs\Rkcc.exe
%HOMEPATH%\gOEYMkgs\WYkG.exe
%HOMEPATH%\gOEYMkgs\EAIA.exe
%HOMEPATH%\gOEYMkgs\AYUI.exe
%HOMEPATH%\gOEYMkgs\dcMW.exe
%HOMEPATH%\gOEYMkgs\uoAU.exe
%HOMEPATH%\gOEYMkgs\WwMs.exe
%HOMEPATH%\gOEYMkgs\ussy.exe
%HOMEPATH%\gOEYMkgs\CUEy.exe
%HOMEPATH%\gOEYMkgs\TMIU.exe
%HOMEPATH%\gOEYMkgs\gEsa.exe
%HOMEPATH%\gOEYMkgs\CQcI.exe
%HOMEPATH%\gOEYMkgs\zUMU.exe
%HOMEPATH%\gOEYMkgs\BcYU.exe
%HOMEPATH%\gOEYMkgs\YgQs.exe
%HOMEPATH%\gOEYMkgs\pEss.exe
%HOMEPATH%\gOEYMkgs\SQUc.exe
%HOMEPATH%\gOEYMkgs\jYEk.exe
%HOMEPATH%\gOEYMkgs\Tksa.exe
%HOMEPATH%\gOEYMkgs\LYYS.exe
%HOMEPATH%\gOEYMkgs\losu.exe
%HOMEPATH%\gOEYMkgs\JkMC.exe
%HOMEPATH%\gOEYMkgs\WkIc.exe
%HOMEPATH%\gOEYMkgs\ZgAy.exe
%HOMEPATH%\gOEYMkgs\iowO.exe
%HOMEPATH%\gOEYMkgs\Gcom.exe
%HOMEPATH%\gOEYMkgs\FoIU.exe
%HOMEPATH%\gOEYMkgs\zQgw.exe
%HOMEPATH%\gOEYMkgs\wEES.exe
%HOMEPATH%\gOEYMkgs\asIw.exe
%HOMEPATH%\gOEYMkgs\GEkA.exe
%HOMEPATH%\gOEYMkgs\GAQi.exe
%HOMEPATH%\gOEYMkgs\VsEw.exe
%HOMEPATH%\gOEYMkgs\iYcS.exe
%HOMEPATH%\gOEYMkgs\XEgA.exe
%HOMEPATH%\gOEYMkgs\zwYe.exe
%HOMEPATH%\gOEYMkgs\RcQI.exe
%HOMEPATH%\gOEYMkgs\jUQg.exe
%HOMEPATH%\gOEYMkgs\XUcM.exe
%TEMP%\bMkgMUsg.bat
%HOMEPATH%\gOEYMkgs\tYEc.exe
%HOMEPATH%\gOEYMkgs\sMgu.exe
%HOMEPATH%\gOEYMkgs\FscY.exe
%HOMEPATH%\gOEYMkgs\qgUo.exe
%HOMEPATH%\gOEYMkgs\Zosw.exe
%HOMEPATH%\gOEYMkgs\SsEW.exe
%HOMEPATH%\gOEYMkgs\tsgq.exe
%HOMEPATH%\gOEYMkgs\GQgQ.exe
%HOMEPATH%\gOEYMkgs\GsIA.exe
%HOMEPATH%\gOEYMkgs\pcYO.exe
%HOMEPATH%\gOEYMkgs\nQMk.exe
%HOMEPATH%\gOEYMkgs\qsog.exe
%HOMEPATH%\gOEYMkgs\NwgK.exe
%HOMEPATH%\gOEYMkgs\hoYm.exe
%HOMEPATH%\gOEYMkgs\oAgA.exe
%HOMEPATH%\gOEYMkgs\NIEq.exe
%HOMEPATH%\gOEYMkgs\HYMe.exe
%HOMEPATH%\gOEYMkgs\isQk.exe
%HOMEPATH%\gOEYMkgs\PQoU.exe
%HOMEPATH%\gOEYMkgs\cIQG.exe
%HOMEPATH%\gOEYMkgs\QckI.exe
%HOMEPATH%\gOEYMkgs\eEEK.exe
%HOMEPATH%\gOEYMkgs\ZwUi.exe
%HOMEPATH%\gOEYMkgs\rMgW.exe
%HOMEPATH%\gOEYMkgs\sAUm.exe
%HOMEPATH%\gOEYMkgs\CMwE.exe
%HOMEPATH%\gOEYMkgs\OsEc.exe
%HOMEPATH%\gOEYMkgs\ZUwm.exe
%HOMEPATH%\gOEYMkgs\WAsA.exe
%HOMEPATH%\gOEYMkgs\jIMg.exe
%HOMEPATH%\gOEYMkgs\GIsK.exe
%HOMEPATH%\gOEYMkgs\dcUK.exe
%HOMEPATH%\gOEYMkgs\vogY.exe
%HOMEPATH%\gOEYMkgs\CIEu.exe
%HOMEPATH%\gOEYMkgs\rgkW.exe
%HOMEPATH%\gOEYMkgs\mMwC.exe
%HOMEPATH%\gOEYMkgs\DIMQ.exe
%HOMEPATH%\gOEYMkgs\cwwY.exe
%HOMEPATH%\gOEYMkgs\MYIk.exe
%HOMEPATH%\gOEYMkgs\poog.exe
%HOMEPATH%\gOEYMkgs\aIEm.exe
%HOMEPATH%\gOEYMkgs\eowW.exe
%HOMEPATH%\gOEYMkgs\DggO.exe
%HOMEPATH%\gOEYMkgs\jEkw.exe
%HOMEPATH%\gOEYMkgs\JcII.exe
%HOMEPATH%\gOEYMkgs\tgwW.exe
%HOMEPATH%\gOEYMkgs\TokC.exe
%HOMEPATH%\gOEYMkgs\HIsY.exe
%HOMEPATH%\gOEYMkgs\uIMA.exe
%HOMEPATH%\gOEYMkgs\lEAK.exe
%HOMEPATH%\gOEYMkgs\gkwo.exe
%HOMEPATH%\gOEYMkgs\bcky.exe

Deletes itself.

Network activity:

Connects to:

'74.##5.232.51':443
'ap#.###coincharts.com':443
'74.##5.232.51':80

TCP:

HTTP GET requests:

http://google.com/ via 74.##5.232.51
http:/// via 74.##5.232.51

UDP:

DNS ASK ma##.google.com
DNS ASK ap#.###coincharts.com
DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Run'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: '' WindowName: 'Open'
ClassName: 'WorkerW' WindowName: ''
ClassName: 'DV2ControlHost' WindowName: ''
ClassName: 'BUTTON' WindowName: 'START'
ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'xSMgIcIg'
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Windows Internet Explorer'
ClassName: '' WindowName: 'Open File'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней