Trojan.DownLoader25.17730

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Infects the following executable files:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Executes the following:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'%TEMP%\setup.exe'
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'<SYSTEM32>\cmd.exe' /c %TEMP%\setup.exe
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Modifies file system:

Creates the following files:

%HOMEPATH%\gOEYMkgs\boEu.exe
%HOMEPATH%\gOEYMkgs\YIQe.exe
%HOMEPATH%\gOEYMkgs\aIEO.exe
%HOMEPATH%\gOEYMkgs\DoUC.exe
%HOMEPATH%\gOEYMkgs\bQkC.exe
%HOMEPATH%\gOEYMkgs\pYAi.exe
%HOMEPATH%\gOEYMkgs\wgcs.exe
%HOMEPATH%\gOEYMkgs\fMMa.exe
%HOMEPATH%\gOEYMkgs\WQck.exe
%HOMEPATH%\gOEYMkgs\JwIc.exe
%HOMEPATH%\gOEYMkgs\ocgc.exe
%HOMEPATH%\gOEYMkgs\pUIq.exe
%HOMEPATH%\gOEYMkgs\vksW.exe
%HOMEPATH%\gOEYMkgs\uIgQ.exe
%HOMEPATH%\gOEYMkgs\cwkk.exe
%HOMEPATH%\gOEYMkgs\DoQO.exe
%HOMEPATH%\gOEYMkgs\EwMo.exe
%HOMEPATH%\gOEYMkgs\MUwM.exe
%HOMEPATH%\gOEYMkgs\xUUC.exe
%HOMEPATH%\gOEYMkgs\QMIs.exe
%HOMEPATH%\gOEYMkgs\tYAU.exe
%HOMEPATH%\gOEYMkgs\xcEO.exe
%HOMEPATH%\gOEYMkgs\mEAk.exe
%HOMEPATH%\gOEYMkgs\NYAy.exe
%HOMEPATH%\gOEYMkgs\Qcgq.exe
%HOMEPATH%\gOEYMkgs\jIgy.exe
%HOMEPATH%\gOEYMkgs\aAQa.exe
%HOMEPATH%\gOEYMkgs\mwoY.exe
%HOMEPATH%\gOEYMkgs\doMG.exe
%HOMEPATH%\gOEYMkgs\fgcg.exe
%HOMEPATH%\gOEYMkgs\YcUq.exe
%HOMEPATH%\gOEYMkgs\vwUS.exe
%HOMEPATH%\gOEYMkgs\Okko.exe
%HOMEPATH%\gOEYMkgs\VMIc.exe
%HOMEPATH%\gOEYMkgs\tcMq.exe
%HOMEPATH%\gOEYMkgs\MgwQ.exe
%HOMEPATH%\gOEYMkgs\hsoQ.exe
%HOMEPATH%\gOEYMkgs\lQUq.exe
%HOMEPATH%\gOEYMkgs\GUwk.exe
%HOMEPATH%\gOEYMkgs\hAga.exe
%HOMEPATH%\gOEYMkgs\oEoc.exe
%HOMEPATH%\gOEYMkgs\nEEM.exe
%HOMEPATH%\gOEYMkgs\LQga.exe
%HOMEPATH%\gOEYMkgs\vEoK.exe
%HOMEPATH%\gOEYMkgs\dUcu.exe
%HOMEPATH%\gOEYMkgs\MwUi.exe
%HOMEPATH%\gOEYMkgs\oocC.exe
%HOMEPATH%\gOEYMkgs\NkUw.exe
%HOMEPATH%\gOEYMkgs\acQA.exe
%HOMEPATH%\gOEYMkgs\qoog.exe
%HOMEPATH%\gOEYMkgs\WsYs.exe
%HOMEPATH%\gOEYMkgs\QkQc.exe
%HOMEPATH%\gOEYMkgs\wkYW.exe
%HOMEPATH%\gOEYMkgs\XYQc.exe
%HOMEPATH%\gOEYMkgs\akYq.exe
%HOMEPATH%\gOEYMkgs\gYQk.exe
%HOMEPATH%\gOEYMkgs\TQcO.exe
%HOMEPATH%\gOEYMkgs\lsYQ.exe
%HOMEPATH%\gOEYMkgs\kcME.exe
%HOMEPATH%\gOEYMkgs\lQgm.exe
%HOMEPATH%\gOEYMkgs\uwAO.exe
%HOMEPATH%\gOEYMkgs\vIQm.exe
%HOMEPATH%\gOEYMkgs\bgMC.exe
%HOMEPATH%\gOEYMkgs\IUUQ.exe
%HOMEPATH%\gOEYMkgs\xEga.exe
%HOMEPATH%\gOEYMkgs\lYQU.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
%HOMEPATH%\gOEYMkgs\EIsu.exe
%HOMEPATH%\gOEYMkgs\iYUe.exe
%HOMEPATH%\gOEYMkgs\aAcG.exe
%HOMEPATH%\gOEYMkgs\IMYE.exe
%HOMEPATH%\gOEYMkgs\RsYe.exe
%HOMEPATH%\gOEYMkgs\CQYM.exe
%HOMEPATH%\gOEYMkgs\roQM.exe
%HOMEPATH%\gOEYMkgs\PYcU.exe
%HOMEPATH%\gOEYMkgs\WkMK.exe
%TEMP%\WER9b68.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\qsAo.exe
%HOMEPATH%\gOEYMkgs\VsUI.exe
%HOMEPATH%\gOEYMkgs\okEi.exe
%HOMEPATH%\gOEYMkgs\AcEm.exe
%HOMEPATH%\gOEYMkgs\ngMK.exe
%HOMEPATH%\gOEYMkgs\sEIW.exe
%HOMEPATH%\gOEYMkgs\EYsM.exe
%TEMP%\WER9b68.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\sQAw.exe
%HOMEPATH%\gOEYMkgs\jIIM.exe
%TEMP%\WER9b68.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\jcga.exe
%HOMEPATH%\gOEYMkgs\HYQQ.exe
%HOMEPATH%\gOEYMkgs\WMEa.exe
%HOMEPATH%\gOEYMkgs\ScoG.exe
%HOMEPATH%\gOEYMkgs\pMEE.exe
%HOMEPATH%\gOEYMkgs\TMMS.exe
%HOMEPATH%\gOEYMkgs\OMEA.exe
%HOMEPATH%\gOEYMkgs\SoUE.exe
%TEMP%\WER9b68.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\NIks.exe
%HOMEPATH%\gOEYMkgs\SAMs.exe
%HOMEPATH%\gOEYMkgs\nAIQ.exe
%HOMEPATH%\gOEYMkgs\RgwS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\NsQW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\QoEE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\JccE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\KEEm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%HOMEPATH%\gOEYMkgs\noYQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\acII.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\iUYy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\VwQC.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%HOMEPATH%\gOEYMkgs\dMgq.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\HgAE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\xAUA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\dsMY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%TEMP%\WER3887.dir00\appcompat.txt
%TEMP%\WER3887.dir00\ZgMYMIIE.exe.hdmp
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\owkE.exe
%TEMP%\WER3887.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%TEMP%\WER3887.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\iAok.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\tAss.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\HEQA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%HOMEPATH%\gOEYMkgs\zQUq.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\UIYq.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\YcMu.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\EIsy.exe
%HOMEPATH%\gOEYMkgs\aYYG.exe
%HOMEPATH%\gOEYMkgs\ocMe.exe
%HOMEPATH%\gOEYMkgs\kYwk.exe
%HOMEPATH%\gOEYMkgs\MgMS.exe
%HOMEPATH%\gOEYMkgs\oEgK.exe
%HOMEPATH%\gOEYMkgs\FoIw.exe
%HOMEPATH%\gOEYMkgs\cAgW.exe
%HOMEPATH%\gOEYMkgs\ZgMK.exe
%HOMEPATH%\gOEYMkgs\FoAg.exe
%HOMEPATH%\gOEYMkgs\JwEY.exe
%HOMEPATH%\gOEYMkgs\FgYK.exe
%HOMEPATH%\gOEYMkgs\Ikgq.exe
%HOMEPATH%\gOEYMkgs\FUwG.exe
%HOMEPATH%\gOEYMkgs\QEUO.exe
%HOMEPATH%\gOEYMkgs\RQse.exe
%HOMEPATH%\gOEYMkgs\TkAG.exe
%HOMEPATH%\gOEYMkgs\OMwe.exe
%TEMP%\WER2ffe.dir00\manifest.txt
%TEMP%\WER2ffe.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\oUsq.exe
%HOMEPATH%\gOEYMkgs\rsgG.exe
%HOMEPATH%\gOEYMkgs\DIIs.exe
%TEMP%\WER2ffe.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\rAIo.exe
%TEMP%\WER2ffe.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\TwgK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\koga.exe
%TEMP%\WERb24e.dir00\manifest.txt
%TEMP%\WERb24e.dir00\appcompat.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%HOMEPATH%\gOEYMkgs\bAME.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\kEoI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\MgEs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\BcAo.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\wcQe.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%HOMEPATH%\gOEYMkgs\MYYi.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\xkAy.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\HkYc.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\sgMW.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\GIMa.exe

Deletes the following files:

%HOMEPATH%\gOEYMkgs\EYsM.exe
%HOMEPATH%\gOEYMkgs\EwMo.exe
%HOMEPATH%\gOEYMkgs\ngMK.exe
%HOMEPATH%\gOEYMkgs\sEIW.exe
%HOMEPATH%\gOEYMkgs\MUwM.exe
%HOMEPATH%\gOEYMkgs\cwkk.exe
%HOMEPATH%\gOEYMkgs\DoQO.exe
%HOMEPATH%\gOEYMkgs\xUUC.exe
%HOMEPATH%\gOEYMkgs\uIgQ.exe
%HOMEPATH%\gOEYMkgs\jIIM.exe
%HOMEPATH%\gOEYMkgs\SoUE.exe
%HOMEPATH%\gOEYMkgs\VsUI.exe
%HOMEPATH%\gOEYMkgs\nAIQ.exe
%HOMEPATH%\gOEYMkgs\OMEA.exe
%HOMEPATH%\gOEYMkgs\okEi.exe
%HOMEPATH%\gOEYMkgs\qsAo.exe
%HOMEPATH%\gOEYMkgs\sQAw.exe
%HOMEPATH%\gOEYMkgs\AcEm.exe
%HOMEPATH%\gOEYMkgs\WkMK.exe
%HOMEPATH%\gOEYMkgs\mEAk.exe
%HOMEPATH%\gOEYMkgs\JwIc.exe
%HOMEPATH%\gOEYMkgs\ocgc.exe
%HOMEPATH%\gOEYMkgs\YIQe.exe
%HOMEPATH%\gOEYMkgs\aIEO.exe
%HOMEPATH%\gOEYMkgs\pUIq.exe
%HOMEPATH%\gOEYMkgs\WQck.exe
%HOMEPATH%\gOEYMkgs\nEEM.exe
%HOMEPATH%\gOEYMkgs\wgcs.exe
%HOMEPATH%\gOEYMkgs\fMMa.exe
%HOMEPATH%\gOEYMkgs\boEu.exe
%HOMEPATH%\gOEYMkgs\QMIs.exe
%HOMEPATH%\gOEYMkgs\tYAU.exe
%HOMEPATH%\gOEYMkgs\NYAy.exe
%HOMEPATH%\gOEYMkgs\Qcgq.exe
%HOMEPATH%\gOEYMkgs\xcEO.exe
%HOMEPATH%\gOEYMkgs\bQkC.exe
%HOMEPATH%\gOEYMkgs\pYAi.exe
%HOMEPATH%\gOEYMkgs\vksW.exe
%HOMEPATH%\gOEYMkgs\DoUC.exe
%HOMEPATH%\gOEYMkgs\SAMs.exe
%HOMEPATH%\gOEYMkgs\lYQU.exe
%HOMEPATH%\gOEYMkgs\CQYM.exe
%HOMEPATH%\gOEYMkgs\IUUQ.exe
%HOMEPATH%\gOEYMkgs\xEga.exe
%HOMEPATH%\gOEYMkgs\roQM.exe
%HOMEPATH%\gOEYMkgs\IMYE.exe
%HOMEPATH%\gOEYMkgs\RsYe.exe
%HOMEPATH%\gOEYMkgs\PYcU.exe
%HOMEPATH%\gOEYMkgs\aAcG.exe
%HOMEPATH%\gOEYMkgs\iYUe.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize
%HOMEPATH%\gOEYMkgs\EIsu.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log
%HOMEPATH%\gOEYMkgs\bgMC.exe
%HOMEPATH%\gOEYMkgs\ScoG.exe
%HOMEPATH%\gOEYMkgs\pMEE.exe
%HOMEPATH%\gOEYMkgs\lsYQ.exe
%HOMEPATH%\gOEYMkgs\kcME.exe
%HOMEPATH%\gOEYMkgs\TMMS.exe
%HOMEPATH%\gOEYMkgs\WMEa.exe
%HOMEPATH%\gOEYMkgs\NIks.exe
%HOMEPATH%\gOEYMkgs\jcga.exe
%HOMEPATH%\gOEYMkgs\HYQQ.exe
%HOMEPATH%\gOEYMkgs\TQcO.exe
%HOMEPATH%\gOEYMkgs\gYQk.exe
%HOMEPATH%\gOEYMkgs\WsYs.exe
%HOMEPATH%\gOEYMkgs\XYQc.exe
%HOMEPATH%\gOEYMkgs\akYq.exe
%HOMEPATH%\gOEYMkgs\QkQc.exe
%HOMEPATH%\gOEYMkgs\uwAO.exe
%HOMEPATH%\gOEYMkgs\vIQm.exe
%HOMEPATH%\gOEYMkgs\wkYW.exe
%HOMEPATH%\gOEYMkgs\lQgm.exe
%HOMEPATH%\gOEYMkgs\BcAo.exe
%HOMEPATH%\gOEYMkgs\TwgK.exe
%HOMEPATH%\gOEYMkgs\GIMa.exe
%HOMEPATH%\gOEYMkgs\HkYc.exe
%TEMP%\sMUEcUkQ.bat
%HOMEPATH%\gOEYMkgs\bAME.exe
%HOMEPATH%\gOEYMkgs\kEoI.exe
%HOMEPATH%\gOEYMkgs\koga.exe
%HOMEPATH%\gOEYMkgs\MgEs.exe
%HOMEPATH%\gOEYMkgs\sgMW.exe
%HOMEPATH%\gOEYMkgs\Ikgq.exe
%HOMEPATH%\gOEYMkgs\cAgW.exe
%HOMEPATH%\gOEYMkgs\JwEY.exe
%HOMEPATH%\gOEYMkgs\FgYK.exe
%HOMEPATH%\gOEYMkgs\ZgMK.exe
%HOMEPATH%\gOEYMkgs\xkAy.exe
%HOMEPATH%\gOEYMkgs\wcQe.exe
%HOMEPATH%\gOEYMkgs\FoAg.exe
%HOMEPATH%\gOEYMkgs\MYYi.exe
%HOMEPATH%\gOEYMkgs\dMgq.exe
%HOMEPATH%\gOEYMkgs\zQUq.exe
%HOMEPATH%\gOEYMkgs\tAss.exe
%HOMEPATH%\gOEYMkgs\KEEm.exe
%HOMEPATH%\gOEYMkgs\HEQA.exe
%HOMEPATH%\gOEYMkgs\YcMu.exe
%HOMEPATH%\gOEYMkgs\iAok.exe
%HOMEPATH%\gOEYMkgs\owkE.exe
%HOMEPATH%\gOEYMkgs\EIsy.exe
%HOMEPATH%\gOEYMkgs\UIYq.exe
%HOMEPATH%\gOEYMkgs\acII.exe
%HOMEPATH%\gOEYMkgs\dsMY.exe
%HOMEPATH%\gOEYMkgs\HgAE.exe
%HOMEPATH%\gOEYMkgs\iUYy.exe
%HOMEPATH%\gOEYMkgs\VwQC.exe
%HOMEPATH%\gOEYMkgs\xAUA.exe
%HOMEPATH%\gOEYMkgs\NsQW.exe
%HOMEPATH%\gOEYMkgs\noYQ.exe
%HOMEPATH%\gOEYMkgs\QoEE.exe
%HOMEPATH%\gOEYMkgs\JccE.exe
%HOMEPATH%\gOEYMkgs\kYwk.exe
%HOMEPATH%\gOEYMkgs\doMG.exe
%HOMEPATH%\gOEYMkgs\fgcg.exe
%HOMEPATH%\gOEYMkgs\oocC.exe
%HOMEPATH%\gOEYMkgs\lQUq.exe
%HOMEPATH%\gOEYMkgs\YcUq.exe
%HOMEPATH%\gOEYMkgs\mwoY.exe
%HOMEPATH%\gOEYMkgs\tcMq.exe
%HOMEPATH%\gOEYMkgs\jIgy.exe
%HOMEPATH%\gOEYMkgs\aAQa.exe
%HOMEPATH%\gOEYMkgs\MwUi.exe
%HOMEPATH%\gOEYMkgs\GUwk.exe
%HOMEPATH%\gOEYMkgs\hAga.exe
%HOMEPATH%\gOEYMkgs\LQga.exe
%HOMEPATH%\gOEYMkgs\vEoK.exe
%HOMEPATH%\gOEYMkgs\oEoc.exe
%HOMEPATH%\gOEYMkgs\qoog.exe
%HOMEPATH%\gOEYMkgs\dUcu.exe
%HOMEPATH%\gOEYMkgs\NkUw.exe
%HOMEPATH%\gOEYMkgs\acQA.exe
%HOMEPATH%\gOEYMkgs\MgwQ.exe
%HOMEPATH%\gOEYMkgs\DIIs.exe
%HOMEPATH%\gOEYMkgs\FUwG.exe
%HOMEPATH%\gOEYMkgs\oUsq.exe
%HOMEPATH%\gOEYMkgs\rsgG.exe
%HOMEPATH%\gOEYMkgs\MgMS.exe
%HOMEPATH%\gOEYMkgs\aYYG.exe
%HOMEPATH%\gOEYMkgs\ocMe.exe
%HOMEPATH%\gOEYMkgs\oEgK.exe
%HOMEPATH%\gOEYMkgs\FoIw.exe
%HOMEPATH%\gOEYMkgs\rAIo.exe
%HOMEPATH%\gOEYMkgs\Okko.exe
%HOMEPATH%\gOEYMkgs\VMIc.exe
%HOMEPATH%\gOEYMkgs\hsoQ.exe
%HOMEPATH%\gOEYMkgs\vwUS.exe
%HOMEPATH%\gOEYMkgs\RgwS.exe
%HOMEPATH%\gOEYMkgs\RQse.exe
%HOMEPATH%\gOEYMkgs\TkAG.exe
%HOMEPATH%\gOEYMkgs\OMwe.exe
%HOMEPATH%\gOEYMkgs\QEUO.exe

Substitutes the following files:

%HOMEPATH%\gOEYMkgs\MUwM.exe

Network activity:

Connects to:

'74.##5.232.51':80

TCP:

HTTP GET requests:

http:/// via 74.##5.232.51
http://google.com/ via 74.##5.232.51

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'lacMcYws.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней