Trojan.MulDrop7.35973

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Infects the following executable files:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Executes the following:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Modifies file system:

Creates the following files:

%HOMEPATH%\gOEYMkgs\skgW.exe
%HOMEPATH%\gOEYMkgs\jQAg.exe
%HOMEPATH%\gOEYMkgs\ioge.exe
%HOMEPATH%\gOEYMkgs\hYsM.exe
%HOMEPATH%\gOEYMkgs\aAcU.exe
%HOMEPATH%\gOEYMkgs\FsAu.exe
%HOMEPATH%\gOEYMkgs\LQsW.exe
%HOMEPATH%\gOEYMkgs\cwsW.exe
%HOMEPATH%\gOEYMkgs\CYgW.exe
%HOMEPATH%\gOEYMkgs\UEcy.exe
%HOMEPATH%\gOEYMkgs\zowi.exe
%HOMEPATH%\gOEYMkgs\RQsA.exe
%HOMEPATH%\gOEYMkgs\fMga.exe
%HOMEPATH%\gOEYMkgs\uYYs.exe
%HOMEPATH%\gOEYMkgs\XgUc.exe
%HOMEPATH%\gOEYMkgs\LgcM.exe
%HOMEPATH%\gOEYMkgs\ssUA.exe
%HOMEPATH%\gOEYMkgs\LcYI.exe
%HOMEPATH%\gOEYMkgs\xEsK.exe
%HOMEPATH%\gOEYMkgs\rwEm.exe
%HOMEPATH%\gOEYMkgs\AIAe.exe
%HOMEPATH%\gOEYMkgs\JksS.exe
%HOMEPATH%\gOEYMkgs\McMS.exe
%HOMEPATH%\gOEYMkgs\VEQO.exe
%HOMEPATH%\gOEYMkgs\UAsU.exe
%HOMEPATH%\gOEYMkgs\VMQG.exe
%HOMEPATH%\gOEYMkgs\RcMk.exe
%HOMEPATH%\gOEYMkgs\bMQu.exe
%HOMEPATH%\gOEYMkgs\DcwG.exe
%HOMEPATH%\gOEYMkgs\CEEI.exe
%HOMEPATH%\gOEYMkgs\vcYs.exe
%HOMEPATH%\gOEYMkgs\DoAy.exe
%HOMEPATH%\gOEYMkgs\tIsI.exe
%HOMEPATH%\gOEYMkgs\rEgu.exe
%HOMEPATH%\gOEYMkgs\NIwk.exe
%HOMEPATH%\gOEYMkgs\wQoY.exe
%HOMEPATH%\gOEYMkgs\MssS.exe
%HOMEPATH%\gOEYMkgs\KkYU.exe
%HOMEPATH%\gOEYMkgs\psoa.exe
%HOMEPATH%\gOEYMkgs\QQIc.exe
%HOMEPATH%\gOEYMkgs\GUEw.exe
%TEMP%\WER4884.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\FgQo.exe
%HOMEPATH%\gOEYMkgs\Jcwu.exe
%HOMEPATH%\gOEYMkgs\nQoq.exe
%HOMEPATH%\gOEYMkgs\dIgI.exe
%HOMEPATH%\gOEYMkgs\XswI.exe
%HOMEPATH%\gOEYMkgs\YQsC.exe
%HOMEPATH%\gOEYMkgs\qYUk.exe
%HOMEPATH%\gOEYMkgs\lsUg.exe
%TEMP%\WER4884.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\mUUM.exe
%TEMP%\WER4884.dir00\manifest.txt
%TEMP%\WER4884.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\bQwW.exe
%HOMEPATH%\gOEYMkgs\Dcoq.exe
%HOMEPATH%\gOEYMkgs\AkUc.exe
%HOMEPATH%\gOEYMkgs\Ckgg.exe
%HOMEPATH%\gOEYMkgs\sQMs.exe
%HOMEPATH%\gOEYMkgs\OsQK.exe
%HOMEPATH%\gOEYMkgs\moMy.exe
%HOMEPATH%\gOEYMkgs\tgcs.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%HOMEPATH%\gOEYMkgs\PQQk.exe
%HOMEPATH%\gOEYMkgs\sgcQ.exe
%HOMEPATH%\gOEYMkgs\uIMs.exe
%HOMEPATH%\gOEYMkgs\aYgq.exe
%HOMEPATH%\gOEYMkgs\pYcK.exe
%TEMP%\WER3e8d.dir00\ZgMYMIIE.exe.mdmp
%TEMP%\WERa940.dir00\ZgMYMIIE.exe.mdmp
%TEMP%\WER3e8d.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\CYYs.exe
%TEMP%\WERa940.dir00\manifest.txt
%TEMP%\WERa940.dir00\appcompat.txt
%TEMP%\WERa940.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER3e8d.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\fAIU.exe
%HOMEPATH%\gOEYMkgs\YsYq.exe
%HOMEPATH%\gOEYMkgs\FsgW.exe
%HOMEPATH%\gOEYMkgs\YEoq.exe
%TEMP%\WER3e8d.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\cIIm.exe
%HOMEPATH%\gOEYMkgs\qUMm.exe
%TEMP%\WERc674.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\PgUk.exe
%HOMEPATH%\gOEYMkgs\EAMk.exe
%HOMEPATH%\gOEYMkgs\cQMg.exe
%HOMEPATH%\gOEYMkgs\dIkg.exe
%HOMEPATH%\gOEYMkgs\fYUs.exe
%HOMEPATH%\gOEYMkgs\AgkA.exe
%HOMEPATH%\gOEYMkgs\BgUm.exe
%HOMEPATH%\gOEYMkgs\mogO.exe
%HOMEPATH%\gOEYMkgs\poog.exe
%HOMEPATH%\gOEYMkgs\Ykoo.exe
%HOMEPATH%\gOEYMkgs\ekcI.exe
%HOMEPATH%\gOEYMkgs\HYwM.exe
%HOMEPATH%\gOEYMkgs\OIQC.exe
%HOMEPATH%\gOEYMkgs\xEMe.exe
%HOMEPATH%\gOEYMkgs\NgwQ.exe
%HOMEPATH%\gOEYMkgs\RgAY.exe
%HOMEPATH%\gOEYMkgs\zcgI.exe
%HOMEPATH%\gOEYMkgs\ZsQQ.exe
%HOMEPATH%\gOEYMkgs\bMAi.exe
%HOMEPATH%\gOEYMkgs\TAQG.exe
%TEMP%\WERc674.dir00\appcompat.txt
%TEMP%\WERc674.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\qAIY.exe
%HOMEPATH%\gOEYMkgs\dsca.exe
%TEMP%\WERc674.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\hMgM.exe
%HOMEPATH%\gOEYMkgs\ZwcU.exe
%HOMEPATH%\gOEYMkgs\Sssa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\uAIy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\JMEa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%HOMEPATH%\gOEYMkgs\qsUI.exe
%TEMP%\WEReb58.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\LokA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\Aswk.exe
%HOMEPATH%\gOEYMkgs\fsUY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\vAQG.exe
%TEMP%\WER672f.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\GcQu.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\LgkW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\wwYU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\yocU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\JgEA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%ALLUSERSPROFILE%\caQc.txt
%TEMP%\WER7146.dir00\manifest.txt
%TEMP%\WER7146.dir00\appcompat.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\woAy.exe
<Current directory>\<File name>
%TEMP%\WER7146.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%TEMP%\WER7146.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\nQkc.exe
%HOMEPATH%\gOEYMkgs\kMsg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\lsUc.exe
%TEMP%\WEReb58.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\iYQo.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%TEMP%\WEReb58.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\zkMi.exe
%TEMP%\WEReb58.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\tcAK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%TEMP%\WERdda7.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\LgIY.exe
%HOMEPATH%\gOEYMkgs\zwgG.exe
%TEMP%\WERdda7.dir00\manifest.txt
%TEMP%\WERdda7.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\AYAS.exe
%TEMP%\WERdda7.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\RYgq.exe
%HOMEPATH%\gOEYMkgs\xYEc.exe
%HOMEPATH%\gOEYMkgs\PsMQ.exe
%HOMEPATH%\gOEYMkgs\UkcE.exe
%HOMEPATH%\gOEYMkgs\oUAM.exe
%HOMEPATH%\gOEYMkgs\tQow.exe
%HOMEPATH%\gOEYMkgs\lMEw.exe
%HOMEPATH%\gOEYMkgs\eAIu.exe
%HOMEPATH%\gOEYMkgs\VkoO.exe
%HOMEPATH%\gOEYMkgs\egUm.exe
%HOMEPATH%\gOEYMkgs\rYwC.exe
%HOMEPATH%\gOEYMkgs\Fscq.exe
%HOMEPATH%\gOEYMkgs\ccEo.exe
%HOMEPATH%\gOEYMkgs\loMy.exe
%HOMEPATH%\gOEYMkgs\oQAA.exe
%HOMEPATH%\gOEYMkgs\TkAG.exe
%HOMEPATH%\gOEYMkgs\sAky.exe
%HOMEPATH%\gOEYMkgs\RwIu.exe
%HOMEPATH%\gOEYMkgs\HQAG.exe
%HOMEPATH%\gOEYMkgs\TMMa.exe
%HOMEPATH%\gOEYMkgs\SYco.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\xUMM.exe
%TEMP%\WER672f.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\xwMU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\KsQu.exe
%TEMP%\WER672f.dir00\appcompat.txt
%TEMP%\WER672f.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\EUIo.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\dkYU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\sYoS.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%HOMEPATH%\gOEYMkgs\ewEs.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\PEgq.exe
%HOMEPATH%\gOEYMkgs\sEMQ.exe
%HOMEPATH%\gOEYMkgs\FIIY.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\EAsy.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\jAUo.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe

Deletes the following files:

%HOMEPATH%\gOEYMkgs\UAsU.exe
%HOMEPATH%\gOEYMkgs\VMQG.exe
%HOMEPATH%\gOEYMkgs\ssUA.exe
%HOMEPATH%\gOEYMkgs\AIAe.exe
%HOMEPATH%\gOEYMkgs\RcMk.exe
%HOMEPATH%\gOEYMkgs\VEQO.exe
%HOMEPATH%\gOEYMkgs\uYYs.exe
%HOMEPATH%\gOEYMkgs\JksS.exe
%HOMEPATH%\gOEYMkgs\McMS.exe
%HOMEPATH%\gOEYMkgs\LgcM.exe
%HOMEPATH%\gOEYMkgs\BgUm.exe
%HOMEPATH%\gOEYMkgs\mogO.exe
%HOMEPATH%\gOEYMkgs\ekcI.exe
%HOMEPATH%\gOEYMkgs\HYwM.exe
%HOMEPATH%\gOEYMkgs\poog.exe
%HOMEPATH%\gOEYMkgs\rwEm.exe
%HOMEPATH%\gOEYMkgs\XgUc.exe
%HOMEPATH%\gOEYMkgs\LcYI.exe
%HOMEPATH%\gOEYMkgs\xEsK.exe
%HOMEPATH%\gOEYMkgs\UEcy.exe
%HOMEPATH%\gOEYMkgs\bMQu.exe
%HOMEPATH%\gOEYMkgs\cwsW.exe
%HOMEPATH%\gOEYMkgs\CYgW.exe
%HOMEPATH%\gOEYMkgs\dIgI.exe
%HOMEPATH%\gOEYMkgs\FgQo.exe
%HOMEPATH%\gOEYMkgs\Jcwu.exe
%HOMEPATH%\gOEYMkgs\XswI.exe
%HOMEPATH%\gOEYMkgs\YQsC.exe
%HOMEPATH%\gOEYMkgs\fMga.exe
%HOMEPATH%\gOEYMkgs\FsAu.exe
%HOMEPATH%\gOEYMkgs\skgW.exe
%HOMEPATH%\gOEYMkgs\hYsM.exe
%HOMEPATH%\gOEYMkgs\aAcU.exe
%HOMEPATH%\gOEYMkgs\jQAg.exe
%HOMEPATH%\gOEYMkgs\zowi.exe
%HOMEPATH%\gOEYMkgs\RQsA.exe
%HOMEPATH%\gOEYMkgs\ioge.exe
%HOMEPATH%\gOEYMkgs\LQsW.exe
%HOMEPATH%\gOEYMkgs\tgcs.exe
%HOMEPATH%\gOEYMkgs\uIMs.exe
%HOMEPATH%\gOEYMkgs\AkUc.exe
%HOMEPATH%\gOEYMkgs\Ckgg.exe
%HOMEPATH%\gOEYMkgs\aYgq.exe
%HOMEPATH%\gOEYMkgs\sgcQ.exe
%HOMEPATH%\gOEYMkgs\qUMm.exe
%HOMEPATH%\gOEYMkgs\pYcK.exe
%HOMEPATH%\gOEYMkgs\PQQk.exe
%HOMEPATH%\gOEYMkgs\Dcoq.exe
%HOMEPATH%\gOEYMkgs\cIIm.exe
%HOMEPATH%\gOEYMkgs\fAIU.exe
%HOMEPATH%\gOEYMkgs\CYYs.exe
%HOMEPATH%\gOEYMkgs\YEoq.exe
%HOMEPATH%\gOEYMkgs\YsYq.exe
%HOMEPATH%\gOEYMkgs\OsQK.exe
%HOMEPATH%\gOEYMkgs\moMy.exe
%HOMEPATH%\gOEYMkgs\FsgW.exe
%HOMEPATH%\gOEYMkgs\sQMs.exe
%HOMEPATH%\gOEYMkgs\dIkg.exe
%HOMEPATH%\gOEYMkgs\fYUs.exe
%HOMEPATH%\gOEYMkgs\OIQC.exe
%HOMEPATH%\gOEYMkgs\cQMg.exe
%HOMEPATH%\gOEYMkgs\PgUk.exe
%HOMEPATH%\gOEYMkgs\Ykoo.exe
%TEMP%\myQccEsE.bat
%HOMEPATH%\gOEYMkgs\EAMk.exe
%HOMEPATH%\gOEYMkgs\AgkA.exe
%HOMEPATH%\gOEYMkgs\qAIY.exe
%HOMEPATH%\gOEYMkgs\bMAi.exe
%HOMEPATH%\gOEYMkgs\xEMe.exe
%HOMEPATH%\gOEYMkgs\zcgI.exe
%HOMEPATH%\gOEYMkgs\ZsQQ.exe
%HOMEPATH%\gOEYMkgs\NgwQ.exe
%HOMEPATH%\gOEYMkgs\dsca.exe
%HOMEPATH%\gOEYMkgs\hMgM.exe
%HOMEPATH%\gOEYMkgs\RgAY.exe
%HOMEPATH%\gOEYMkgs\TAQG.exe
%HOMEPATH%\gOEYMkgs\xwMU.exe
%HOMEPATH%\gOEYMkgs\KsQu.exe
%HOMEPATH%\gOEYMkgs\FIIY.exe
%HOMEPATH%\gOEYMkgs\EAsy.exe
%HOMEPATH%\gOEYMkgs\xUMM.exe
%HOMEPATH%\gOEYMkgs\GcQu.exe
%HOMEPATH%\gOEYMkgs\LgkW.exe
%HOMEPATH%\gOEYMkgs\dkYU.exe
%HOMEPATH%\gOEYMkgs\EUIo.exe
%HOMEPATH%\gOEYMkgs\jAUo.exe
%HOMEPATH%\gOEYMkgs\xYEc.exe
%HOMEPATH%\gOEYMkgs\PsMQ.exe
%HOMEPATH%\gOEYMkgs\tQow.exe
%HOMEPATH%\gOEYMkgs\RYgq.exe
%HOMEPATH%\gOEYMkgs\SYco.exe
%HOMEPATH%\gOEYMkgs\sYoS.exe
%HOMEPATH%\gOEYMkgs\sEMQ.exe
%HOMEPATH%\gOEYMkgs\ewEs.exe
%HOMEPATH%\gOEYMkgs\PEgq.exe
%HOMEPATH%\gOEYMkgs\kMsg.exe
%HOMEPATH%\gOEYMkgs\lsUc.exe
%HOMEPATH%\gOEYMkgs\qsUI.exe
%HOMEPATH%\gOEYMkgs\iYQo.exe
%HOMEPATH%\gOEYMkgs\tcAK.exe
%HOMEPATH%\gOEYMkgs\woAy.exe
%TEMP%\wsMckYQE.bat
%HOMEPATH%\gOEYMkgs\zkMi.exe
%HOMEPATH%\gOEYMkgs\nQkc.exe
%HOMEPATH%\gOEYMkgs\Aswk.exe
%HOMEPATH%\gOEYMkgs\JgEA.exe
%HOMEPATH%\gOEYMkgs\wwYU.exe
%HOMEPATH%\gOEYMkgs\vAQG.exe
%HOMEPATH%\gOEYMkgs\yocU.exe
%HOMEPATH%\gOEYMkgs\fsUY.exe
%HOMEPATH%\gOEYMkgs\uAIy.exe
%HOMEPATH%\gOEYMkgs\LokA.exe
%HOMEPATH%\gOEYMkgs\JMEa.exe
%HOMEPATH%\gOEYMkgs\Sssa.exe
%HOMEPATH%\gOEYMkgs\psoa.exe
%HOMEPATH%\gOEYMkgs\QQIc.exe
%HOMEPATH%\gOEYMkgs\vcYs.exe
%HOMEPATH%\gOEYMkgs\NIwk.exe
%HOMEPATH%\gOEYMkgs\GUEw.exe
%HOMEPATH%\gOEYMkgs\KkYU.exe
%HOMEPATH%\gOEYMkgs\ZwcU.exe
%HOMEPATH%\gOEYMkgs\wQoY.exe
%HOMEPATH%\gOEYMkgs\MssS.exe
%HOMEPATH%\gOEYMkgs\CEEI.exe
%HOMEPATH%\gOEYMkgs\bQwW.exe
%HOMEPATH%\gOEYMkgs\lsUg.exe
%HOMEPATH%\gOEYMkgs\nQoq.exe
%HOMEPATH%\gOEYMkgs\qYUk.exe
%HOMEPATH%\gOEYMkgs\mUUM.exe
%HOMEPATH%\gOEYMkgs\rEgu.exe
%HOMEPATH%\gOEYMkgs\DcwG.exe
%HOMEPATH%\gOEYMkgs\DoAy.exe
%HOMEPATH%\gOEYMkgs\tIsI.exe
%HOMEPATH%\gOEYMkgs\sAky.exe
%HOMEPATH%\gOEYMkgs\lMEw.exe
%HOMEPATH%\gOEYMkgs\oQAA.exe
%HOMEPATH%\gOEYMkgs\TkAG.exe
%HOMEPATH%\gOEYMkgs\AYAS.exe
%HOMEPATH%\gOEYMkgs\UkcE.exe
%HOMEPATH%\gOEYMkgs\oUAM.exe
%HOMEPATH%\gOEYMkgs\LgIY.exe
%HOMEPATH%\gOEYMkgs\zwgG.exe
%HOMEPATH%\gOEYMkgs\TMMa.exe
%HOMEPATH%\gOEYMkgs\ccEo.exe
%HOMEPATH%\gOEYMkgs\eAIu.exe
%HOMEPATH%\gOEYMkgs\rYwC.exe
%HOMEPATH%\gOEYMkgs\Fscq.exe
%HOMEPATH%\gOEYMkgs\VkoO.exe
%HOMEPATH%\gOEYMkgs\RwIu.exe
%HOMEPATH%\gOEYMkgs\HQAG.exe
%HOMEPATH%\gOEYMkgs\egUm.exe
%HOMEPATH%\gOEYMkgs\loMy.exe

Deletes itself.

Network activity:

Connects to:

'74.##5.232.51':80

TCP:

HTTP GET requests:

http://google.com/ via 74.##5.232.51
http:/// via 74.##5.232.51

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'SSIkQYgQ.exe'

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней