Trojan.MulDrop7.35991

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Infects the following executable files:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Executes the following:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Modifies file system:

Creates the following files:

%HOMEPATH%\gOEYMkgs\IAoo.exe
%HOMEPATH%\gOEYMkgs\ukss.exe
%HOMEPATH%\gOEYMkgs\XIoK.exe
%HOMEPATH%\gOEYMkgs\YwwG.exe
%HOMEPATH%\gOEYMkgs\NUcW.exe
%HOMEPATH%\gOEYMkgs\FIYi.exe
%HOMEPATH%\gOEYMkgs\VoUA.exe
%HOMEPATH%\gOEYMkgs\Owsk.exe
%HOMEPATH%\gOEYMkgs\kkAK.exe
%HOMEPATH%\gOEYMkgs\rggk.exe
%HOMEPATH%\gOEYMkgs\rYsU.exe
%HOMEPATH%\gOEYMkgs\vwsw.exe
%HOMEPATH%\gOEYMkgs\dEMI.exe
%HOMEPATH%\gOEYMkgs\OEcq.exe
%HOMEPATH%\gOEYMkgs\Rocg.exe
%HOMEPATH%\gOEYMkgs\qEMs.exe
%HOMEPATH%\gOEYMkgs\LgII.exe
%HOMEPATH%\gOEYMkgs\jwEy.exe
%HOMEPATH%\gOEYMkgs\jsEG.exe
%HOMEPATH%\gOEYMkgs\LYcE.exe
%HOMEPATH%\gOEYMkgs\UgAs.exe
%HOMEPATH%\gOEYMkgs\ywQC.exe
%HOMEPATH%\gOEYMkgs\ksIs.exe
%HOMEPATH%\gOEYMkgs\WksC.exe
%HOMEPATH%\gOEYMkgs\lwUe.exe
%HOMEPATH%\gOEYMkgs\KQka.exe
%HOMEPATH%\gOEYMkgs\MAEq.exe
%HOMEPATH%\gOEYMkgs\KYoC.exe
%HOMEPATH%\gOEYMkgs\XQwq.exe
%HOMEPATH%\gOEYMkgs\zgAe.exe
%HOMEPATH%\gOEYMkgs\BQwK.exe
%HOMEPATH%\gOEYMkgs\mYQO.exe
%HOMEPATH%\gOEYMkgs\pksG.exe
%HOMEPATH%\gOEYMkgs\ggwo.exe
%HOMEPATH%\gOEYMkgs\nQAU.exe
%HOMEPATH%\gOEYMkgs\Pckk.exe
%HOMEPATH%\gOEYMkgs\xcAY.exe
%HOMEPATH%\gOEYMkgs\dUIW.exe
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
%HOMEPATH%\gOEYMkgs\bMwK.exe
%HOMEPATH%\gOEYMkgs\IoYg.exe
%HOMEPATH%\gOEYMkgs\BMIE.exe
%HOMEPATH%\gOEYMkgs\mIgk.exe
%HOMEPATH%\gOEYMkgs\BIoy.exe
%HOMEPATH%\gOEYMkgs\oAoG.exe
%HOMEPATH%\gOEYMkgs\jggK.exe
%HOMEPATH%\gOEYMkgs\MMQE.exe
%HOMEPATH%\gOEYMkgs\fcQQ.exe
%HOMEPATH%\gOEYMkgs\WMca.exe
%HOMEPATH%\gOEYMkgs\EoIe.exe
%HOMEPATH%\gOEYMkgs\qcEw.exe
%HOMEPATH%\gOEYMkgs\DAoK.exe
%HOMEPATH%\gOEYMkgs\EsQo.exe
%HOMEPATH%\gOEYMkgs\poQu.exe
%HOMEPATH%\gOEYMkgs\IUow.exe
%HOMEPATH%\gOEYMkgs\PsUk.exe
%HOMEPATH%\gOEYMkgs\asww.exe
%HOMEPATH%\gOEYMkgs\vMki.exe
%HOMEPATH%\gOEYMkgs\zkkU.exe
%HOMEPATH%\gOEYMkgs\iMAs.exe
%HOMEPATH%\gOEYMkgs\fkYs.exe
%HOMEPATH%\gOEYMkgs\WYcG.exe
%HOMEPATH%\gOEYMkgs\VwMw.exe
%HOMEPATH%\gOEYMkgs\PYgS.exe
%HOMEPATH%\gOEYMkgs\lUcO.exe
%HOMEPATH%\gOEYMkgs\JUkY.exe
%HOMEPATH%\gOEYMkgs\OkQI.exe
%HOMEPATH%\gOEYMkgs\iUQU.exe
%HOMEPATH%\gOEYMkgs\MYwe.exe
%HOMEPATH%\gOEYMkgs\aEsE.exe
%HOMEPATH%\gOEYMkgs\rosy.exe
%HOMEPATH%\gOEYMkgs\eIYG.exe
%HOMEPATH%\gOEYMkgs\rkgA.exe
%HOMEPATH%\gOEYMkgs\vooS.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%HOMEPATH%\gOEYMkgs\qcwe.exe
%HOMEPATH%\gOEYMkgs\uMYo.exe
%HOMEPATH%\gOEYMkgs\LMAw.exe
%HOMEPATH%\gOEYMkgs\Mkgm.exe
%HOMEPATH%\gOEYMkgs\pQQM.exe
%HOMEPATH%\gOEYMkgs\ucok.exe
%HOMEPATH%\gOEYMkgs\AkMy.exe
%HOMEPATH%\gOEYMkgs\lcEk.exe
%HOMEPATH%\gOEYMkgs\TEUq.exe
%HOMEPATH%\gOEYMkgs\aYIQ.exe
%HOMEPATH%\gOEYMkgs\iswg.exe
%HOMEPATH%\gOEYMkgs\jgci.exe
%HOMEPATH%\gOEYMkgs\oUgQ.exe
%HOMEPATH%\gOEYMkgs\rskc.exe
%HOMEPATH%\gOEYMkgs\uEYo.exe
%HOMEPATH%\gOEYMkgs\ZQsq.exe
%HOMEPATH%\gOEYMkgs\ZwwG.exe
%HOMEPATH%\gOEYMkgs\rUoi.exe
%HOMEPATH%\gOEYMkgs\bcwC.exe
%HOMEPATH%\gOEYMkgs\cwkU.exe
%HOMEPATH%\gOEYMkgs\rQAW.exe
%HOMEPATH%\gOEYMkgs\HcEo.exe
%HOMEPATH%\gOEYMkgs\mksw.exe
%HOMEPATH%\gOEYMkgs\nYYk.exe
%HOMEPATH%\gOEYMkgs\pMoY.exe
%HOMEPATH%\gOEYMkgs\Ogci.exe
%HOMEPATH%\gOEYMkgs\AcYo.exe
%HOMEPATH%\gOEYMkgs\sUos.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\pEQW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\Poki.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\ikgm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%HOMEPATH%\gOEYMkgs\CYwK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\lAoa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%HOMEPATH%\gOEYMkgs\xYwy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\XYYW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\NUca.exe
%HOMEPATH%\gOEYMkgs\JUUm.exe
%TEMP%\WER18a4.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\gUoA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\GUgO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\ekgm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\AYYY.exe
%TEMP%\WER2811.dir00\manifest.txt
%TEMP%\WER2811.dir00\appcompat.txt
%TEMP%\WER2811.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WERa1bf.dir00\ZgMYMIIE.exe.mdmp
<Current directory>\<File name>
%ALLUSERSPROFILE%\caQc.txt
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%TEMP%\WER2811.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%TEMP%\WERa1bf.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\dkgA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\GcUw.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\KUcC.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\rEMg.exe
%TEMP%\WERa1bf.dir00\manifest.txt
%TEMP%\WERa1bf.dir00\appcompat.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\vQEg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\UAoS.exe
%HOMEPATH%\gOEYMkgs\dssA.exe
%HOMEPATH%\gOEYMkgs\GcgQ.exe
%HOMEPATH%\gOEYMkgs\XkgG.exe
%TEMP%\WER9520.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\CYIG.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\SEMM.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\ZEgG.exe
%HOMEPATH%\gOEYMkgs\OoUU.exe
%HOMEPATH%\gOEYMkgs\ccIm.exe
%TEMP%\WER9520.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\iMEQ.exe
%HOMEPATH%\gOEYMkgs\Lssc.exe
%HOMEPATH%\gOEYMkgs\mEUI.exe
%HOMEPATH%\gOEYMkgs\dkcO.exe
%HOMEPATH%\gOEYMkgs\IscO.exe
%HOMEPATH%\gOEYMkgs\eYQe.exe
%TEMP%\WER9520.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\Rswc.exe
%HOMEPATH%\gOEYMkgs\jgkO.exe
%HOMEPATH%\gOEYMkgs\IAgu.exe
%HOMEPATH%\gOEYMkgs\Ksge.exe
%TEMP%\WER9520.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\pUUM.exe
%TEMP%\WER18a4.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\bIkQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\LsUO.exe
%TEMP%\WER18a4.dir00\manifest.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\zcIM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\ZgIK.exe
%TEMP%\WER18a4.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\icYM.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\FYME.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\TEsO.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%HOMEPATH%\gOEYMkgs\aUEo.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\XgwY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\AYgy.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\nwEG.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe

Deletes the following files:

%HOMEPATH%\gOEYMkgs\jgci.exe
%HOMEPATH%\gOEYMkgs\DAoK.exe
%HOMEPATH%\gOEYMkgs\aYIQ.exe
%HOMEPATH%\gOEYMkgs\iswg.exe
%HOMEPATH%\gOEYMkgs\LgII.exe
%HOMEPATH%\gOEYMkgs\OEcq.exe
%HOMEPATH%\gOEYMkgs\Rocg.exe
%HOMEPATH%\gOEYMkgs\jwEy.exe
%HOMEPATH%\gOEYMkgs\jsEG.exe
%HOMEPATH%\gOEYMkgs\TEUq.exe
%HOMEPATH%\gOEYMkgs\Mkgm.exe
%HOMEPATH%\gOEYMkgs\AkMy.exe
%HOMEPATH%\gOEYMkgs\lcEk.exe
%HOMEPATH%\gOEYMkgs\pQQM.exe
%HOMEPATH%\gOEYMkgs\rskc.exe
%HOMEPATH%\gOEYMkgs\uEYo.exe
%HOMEPATH%\gOEYMkgs\ucok.exe
%HOMEPATH%\gOEYMkgs\oUgQ.exe
%HOMEPATH%\gOEYMkgs\qEMs.exe
%HOMEPATH%\gOEYMkgs\ukss.exe
%HOMEPATH%\gOEYMkgs\XIoK.exe
%HOMEPATH%\gOEYMkgs\FIYi.exe
%HOMEPATH%\gOEYMkgs\IAoo.exe
%HOMEPATH%\gOEYMkgs\rggk.exe
%HOMEPATH%\gOEYMkgs\VoUA.exe
%HOMEPATH%\gOEYMkgs\Owsk.exe
%HOMEPATH%\gOEYMkgs\rYsU.exe
%HOMEPATH%\gOEYMkgs\vwsw.exe
%HOMEPATH%\gOEYMkgs\lwUe.exe
%HOMEPATH%\gOEYMkgs\LYcE.exe
%HOMEPATH%\gOEYMkgs\ksIs.exe
%HOMEPATH%\gOEYMkgs\WksC.exe
%HOMEPATH%\gOEYMkgs\UgAs.exe
%HOMEPATH%\gOEYMkgs\YwwG.exe
%HOMEPATH%\gOEYMkgs\NUcW.exe
%HOMEPATH%\gOEYMkgs\ywQC.exe
%HOMEPATH%\gOEYMkgs\dEMI.exe
%HOMEPATH%\gOEYMkgs\ZQsq.exe
%HOMEPATH%\gOEYMkgs\lUcO.exe
%HOMEPATH%\gOEYMkgs\PsUk.exe
%HOMEPATH%\gOEYMkgs\rkgA.exe
%HOMEPATH%\gOEYMkgs\vooS.exe
%HOMEPATH%\gOEYMkgs\asww.exe
%HOMEPATH%\gOEYMkgs\poQu.exe
%HOMEPATH%\gOEYMkgs\IUow.exe
%HOMEPATH%\gOEYMkgs\vMki.exe
%HOMEPATH%\gOEYMkgs\EsQo.exe
%HOMEPATH%\gOEYMkgs\rosy.exe
%HOMEPATH%\gOEYMkgs\JUkY.exe
%HOMEPATH%\gOEYMkgs\MYwe.exe
%HOMEPATH%\gOEYMkgs\aEsE.exe
%HOMEPATH%\gOEYMkgs\OkQI.exe
%HOMEPATH%\gOEYMkgs\uMYo.exe
%HOMEPATH%\gOEYMkgs\eIYG.exe
%HOMEPATH%\gOEYMkgs\iUQU.exe
%HOMEPATH%\gOEYMkgs\qcwe.exe
%HOMEPATH%\gOEYMkgs\WYcG.exe
%HOMEPATH%\gOEYMkgs\bcwC.exe
%HOMEPATH%\gOEYMkgs\Ogci.exe
%HOMEPATH%\gOEYMkgs\ZwwG.exe
%HOMEPATH%\gOEYMkgs\rUoi.exe
%HOMEPATH%\gOEYMkgs\AcYo.exe
%HOMEPATH%\gOEYMkgs\nYYk.exe
%HOMEPATH%\gOEYMkgs\pMoY.exe
%HOMEPATH%\gOEYMkgs\sUos.exe
%HOMEPATH%\gOEYMkgs\mksw.exe
%HOMEPATH%\gOEYMkgs\zkkU.exe
%HOMEPATH%\gOEYMkgs\iMAs.exe
%HOMEPATH%\gOEYMkgs\VwMw.exe
%HOMEPATH%\gOEYMkgs\PYgS.exe
%HOMEPATH%\gOEYMkgs\fkYs.exe
%HOMEPATH%\gOEYMkgs\rQAW.exe
%HOMEPATH%\gOEYMkgs\HcEo.exe
%HOMEPATH%\gOEYMkgs\LMAw.exe
%HOMEPATH%\gOEYMkgs\cwkU.exe
%HOMEPATH%\gOEYMkgs\kkAK.exe
%HOMEPATH%\gOEYMkgs\XgwY.exe
%HOMEPATH%\gOEYMkgs\AYgy.exe
%HOMEPATH%\gOEYMkgs\TEsO.exe
%HOMEPATH%\gOEYMkgs\nwEG.exe
%HOMEPATH%\gOEYMkgs\LsUO.exe
%HOMEPATH%\gOEYMkgs\zcIM.exe
%HOMEPATH%\gOEYMkgs\ZgIK.exe
%HOMEPATH%\gOEYMkgs\bIkQ.exe
%HOMEPATH%\gOEYMkgs\icYM.exe
%HOMEPATH%\gOEYMkgs\ZEgG.exe
%HOMEPATH%\gOEYMkgs\OoUU.exe
%HOMEPATH%\gOEYMkgs\dssA.exe
%HOMEPATH%\gOEYMkgs\GcgQ.exe
%HOMEPATH%\gOEYMkgs\ccIm.exe
%HOMEPATH%\gOEYMkgs\aUEo.exe
%HOMEPATH%\gOEYMkgs\FYME.exe
%HOMEPATH%\gOEYMkgs\SEMM.exe
%HOMEPATH%\gOEYMkgs\pUUM.exe
%HOMEPATH%\gOEYMkgs\JUUm.exe
%HOMEPATH%\gOEYMkgs\AYYY.exe
%HOMEPATH%\gOEYMkgs\KUcC.exe
%HOMEPATH%\gOEYMkgs\xYwy.exe
%HOMEPATH%\gOEYMkgs\CYwK.exe
%HOMEPATH%\gOEYMkgs\dkgA.exe
%HOMEPATH%\gOEYMkgs\rEMg.exe
%TEMP%\dywEkQYs.bat
%HOMEPATH%\gOEYMkgs\GcUw.exe
%HOMEPATH%\gOEYMkgs\vQEg.exe
%HOMEPATH%\gOEYMkgs\ekgm.exe
%HOMEPATH%\gOEYMkgs\gUoA.exe
%HOMEPATH%\gOEYMkgs\XYYW.exe
%HOMEPATH%\gOEYMkgs\NUca.exe
%HOMEPATH%\gOEYMkgs\GUgO.exe
%HOMEPATH%\gOEYMkgs\pEQW.exe
%HOMEPATH%\gOEYMkgs\lAoa.exe
%HOMEPATH%\gOEYMkgs\Poki.exe
%HOMEPATH%\gOEYMkgs\ikgm.exe
%HOMEPATH%\gOEYMkgs\UAoS.exe
%HOMEPATH%\gOEYMkgs\MMQE.exe
%HOMEPATH%\gOEYMkgs\fcQQ.exe
%HOMEPATH%\gOEYMkgs\qcEw.exe
%HOMEPATH%\gOEYMkgs\jggK.exe
%HOMEPATH%\gOEYMkgs\zgAe.exe
%HOMEPATH%\gOEYMkgs\MAEq.exe
%HOMEPATH%\gOEYMkgs\KYoC.exe
%HOMEPATH%\gOEYMkgs\BQwK.exe
%HOMEPATH%\gOEYMkgs\mYQO.exe
%HOMEPATH%\gOEYMkgs\BIoy.exe
%HOMEPATH%\gOEYMkgs\oAoG.exe
%HOMEPATH%\gOEYMkgs\KQka.exe
%HOMEPATH%\gOEYMkgs\mIgk.exe
%HOMEPATH%\gOEYMkgs\bMwK.exe
%HOMEPATH%\gOEYMkgs\WMca.exe
%HOMEPATH%\gOEYMkgs\EoIe.exe
%HOMEPATH%\gOEYMkgs\IoYg.exe
%HOMEPATH%\gOEYMkgs\BMIE.exe
%HOMEPATH%\gOEYMkgs\XQwq.exe
%HOMEPATH%\gOEYMkgs\mEUI.exe
%HOMEPATH%\gOEYMkgs\IAgu.exe
%HOMEPATH%\gOEYMkgs\iMEQ.exe
%HOMEPATH%\gOEYMkgs\Lssc.exe
%HOMEPATH%\gOEYMkgs\Ksge.exe
%HOMEPATH%\gOEYMkgs\XkgG.exe
%HOMEPATH%\gOEYMkgs\CYIG.exe
%HOMEPATH%\gOEYMkgs\Rswc.exe
%HOMEPATH%\gOEYMkgs\jgkO.exe
%HOMEPATH%\gOEYMkgs\dUIW.exe
%HOMEPATH%\gOEYMkgs\pksG.exe
%HOMEPATH%\gOEYMkgs\Pckk.exe
%HOMEPATH%\gOEYMkgs\xcAY.exe
%HOMEPATH%\gOEYMkgs\ggwo.exe
%HOMEPATH%\gOEYMkgs\IscO.exe
%HOMEPATH%\gOEYMkgs\eYQe.exe
%HOMEPATH%\gOEYMkgs\nQAU.exe
%HOMEPATH%\gOEYMkgs\dkcO.exe

Deletes itself.

Network activity:

Connects to:

'74.##5.232.51':80

TCP:

HTTP GET requests:

http://google.com/ via 74.##5.232.51
http:/// via 74.##5.232.51

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'SSIkQYgQ.exe'

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней