Trojan.DownLoader25.4767

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Infects the following executable files:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Executes the following:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'%TEMP%\lotroclient.exe'
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'<SYSTEM32>\cmd.exe' /c %TEMP%\lotroclient.exe
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

Modifies file system:

Creates the following files:

%HOMEPATH%\gOEYMkgs\QEsw.exe
%HOMEPATH%\gOEYMkgs\owAU.exe
%HOMEPATH%\gOEYMkgs\mcMY.exe
%HOMEPATH%\gOEYMkgs\CYos.exe
%TEMP%\WERbc04.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\aAMO.exe
%HOMEPATH%\gOEYMkgs\cYkm.exe
%HOMEPATH%\gOEYMkgs\jssi.exe
%HOMEPATH%\gOEYMkgs\ngkU.exe
%HOMEPATH%\gOEYMkgs\YsMW.exe
%HOMEPATH%\gOEYMkgs\BMQQ.exe
%HOMEPATH%\gOEYMkgs\XUMW.exe
%HOMEPATH%\gOEYMkgs\fMkQ.exe
%HOMEPATH%\gOEYMkgs\TEkI.exe
%HOMEPATH%\gOEYMkgs\dkMA.exe
%TEMP%\WERbc04.dir00\manifest.txt
%TEMP%\WERbc04.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\ZEwe.exe
%HOMEPATH%\gOEYMkgs\wwoW.exe
%HOMEPATH%\gOEYMkgs\wUUm.exe
%HOMEPATH%\gOEYMkgs\IAcG.exe
%HOMEPATH%\gOEYMkgs\JQQM.exe
%HOMEPATH%\gOEYMkgs\yEwO.exe
%HOMEPATH%\gOEYMkgs\XEoe.exe
%TEMP%\WERbc04.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\mIcW.exe
%HOMEPATH%\gOEYMkgs\HQIW.exe
%HOMEPATH%\gOEYMkgs\icMA.exe
%HOMEPATH%\gOEYMkgs\qggm.exe
%HOMEPATH%\gOEYMkgs\EYIM.exe
%HOMEPATH%\gOEYMkgs\aAQu.exe
%TEMP%\WER4169.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER4169.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\qIIE.exe
%HOMEPATH%\gOEYMkgs\wYoA.exe
%TEMP%\WER4169.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\gQMe.exe
%HOMEPATH%\gOEYMkgs\vkIe.exe
%HOMEPATH%\gOEYMkgs\vwYe.exe
%HOMEPATH%\gOEYMkgs\PEMe.exe
%HOMEPATH%\gOEYMkgs\YUgw.exe
%HOMEPATH%\gOEYMkgs\LAgq.exe
%HOMEPATH%\gOEYMkgs\OwgI.exe
%HOMEPATH%\gOEYMkgs\uggK.exe
%HOMEPATH%\gOEYMkgs\kQAy.exe
%HOMEPATH%\gOEYMkgs\wsoU.exe
%HOMEPATH%\gOEYMkgs\TIAQ.exe
%HOMEPATH%\gOEYMkgs\eQoM.exe
%HOMEPATH%\gOEYMkgs\XEIk.exe
%HOMEPATH%\gOEYMkgs\EYcA.exe
%HOMEPATH%\gOEYMkgs\lMEo.exe
%HOMEPATH%\gOEYMkgs\uIQo.exe
%HOMEPATH%\gOEYMkgs\Ocko.exe
%HOMEPATH%\gOEYMkgs\HQcm.exe
%HOMEPATH%\gOEYMkgs\tMIw.exe
%HOMEPATH%\gOEYMkgs\bYwI.exe
%HOMEPATH%\gOEYMkgs\RwgO.exe
%TEMP%\WERa5aa.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WERa5aa.dir00\ZgMYMIIE.exe.mdmp
%TEMP%\WER28ea.dir00\manifest.txt
%TEMP%\WERa5aa.dir00\appcompat.txt
%TEMP%\WER129a.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER129a.dir00\ZgMYMIIE.exe.mdmp
%TEMP%\WERa5aa.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\EwwM.exe
%HOMEPATH%\gOEYMkgs\RQwe.exe
%HOMEPATH%\gOEYMkgs\CgwY.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
%TEMP%\WER28ea.dir00\appcompat.txt
%TEMP%\WER28ea.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER28ea.dir00\ZgMYMIIE.exe.mdmp
%TEMP%\WER05a7.dir00\manifest.txt
%TEMP%\WER05a7.dir00\appcompat.txt
%TEMP%\WER05a7.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER7305.dir00\ZgMYMIIE.exe.mdmp
%TEMP%\WER7305.dir00\manifest.txt
%TEMP%\WER7305.dir00\appcompat.txt
%TEMP%\WER7305.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER88e8.dir00\ZgMYMIIE.exe.mdmp
%TEMP%\WER129a.dir00\manifest.txt
%TEMP%\WER129a.dir00\appcompat.txt
%TEMP%\WER88e8.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER05a7.dir00\ZgMYMIIE.exe.mdmp
%TEMP%\WER88e8.dir00\manifest.txt
%TEMP%\WER88e8.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\awQE.exe
%HOMEPATH%\gOEYMkgs\rccw.exe
%HOMEPATH%\gOEYMkgs\WQcQ.exe
%HOMEPATH%\gOEYMkgs\Wocc.exe
%HOMEPATH%\gOEYMkgs\eoEy.exe
%HOMEPATH%\gOEYMkgs\iowE.exe
%HOMEPATH%\gOEYMkgs\nAUy.exe
%HOMEPATH%\gOEYMkgs\HIcc.exe
%HOMEPATH%\gOEYMkgs\uYco.exe
%HOMEPATH%\gOEYMkgs\eEgQ.exe
%HOMEPATH%\gOEYMkgs\ZcQe.exe
%HOMEPATH%\gOEYMkgs\kQws.exe
%HOMEPATH%\gOEYMkgs\yQEe.exe
%HOMEPATH%\gOEYMkgs\lMYA.exe
%HOMEPATH%\gOEYMkgs\ZAcQ.exe
%HOMEPATH%\gOEYMkgs\cUwC.exe
%HOMEPATH%\gOEYMkgs\lYAG.exe
%HOMEPATH%\gOEYMkgs\iIMQ.exe
%HOMEPATH%\gOEYMkgs\lUIo.exe
%HOMEPATH%\gOEYMkgs\WAIO.exe
%HOMEPATH%\gOEYMkgs\LYEK.exe
%HOMEPATH%\gOEYMkgs\YMcW.exe
%HOMEPATH%\gOEYMkgs\YscK.exe
%HOMEPATH%\gOEYMkgs\FMUk.exe
%HOMEPATH%\gOEYMkgs\VwQg.exe
%HOMEPATH%\gOEYMkgs\oUMk.exe
%HOMEPATH%\gOEYMkgs\eocM.exe
%HOMEPATH%\gOEYMkgs\AYIM.exe
%HOMEPATH%\gOEYMkgs\jQoK.exe
%HOMEPATH%\gOEYMkgs\Esog.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\qwou.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\ZsAQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\vgQw.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\LcIc.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\Mcci.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\kwse.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\fQUI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\ZEEQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\tMwy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\FwwS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\OgEY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\SkYC.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%HOMEPATH%\gOEYMkgs\sQgE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\hQoa.exe
%TEMP%\WER537f.dir00\manifest.txt
%TEMP%\WER537f.dir00\appcompat.txt
%TEMP%\WER537f.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\KkQy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\ykcG.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%TEMP%\WER537f.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%HOMEPATH%\gOEYMkgs\GQAw.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\zgoA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\NggI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%HOMEPATH%\gOEYMkgs\booa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\xoEQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\mgUg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\KQIg.exe
%HOMEPATH%\gOEYMkgs\GgAW.exe
%HOMEPATH%\gOEYMkgs\GIUi.exe
%HOMEPATH%\gOEYMkgs\yMgo.exe
%HOMEPATH%\gOEYMkgs\NMEI.exe
%HOMEPATH%\gOEYMkgs\iUEq.exe
%HOMEPATH%\gOEYMkgs\uIEM.exe
%HOMEPATH%\gOEYMkgs\zkMI.exe
%HOMEPATH%\gOEYMkgs\WsAg.exe
%HOMEPATH%\gOEYMkgs\rUks.exe
%HOMEPATH%\gOEYMkgs\FcYS.exe
%HOMEPATH%\gOEYMkgs\voYM.exe
%HOMEPATH%\gOEYMkgs\iUck.exe
%HOMEPATH%\gOEYMkgs\TYwa.exe
%HOMEPATH%\gOEYMkgs\QwEK.exe
%HOMEPATH%\gOEYMkgs\nAAA.exe
%HOMEPATH%\gOEYMkgs\YMgy.exe
%HOMEPATH%\gOEYMkgs\awQa.exe
%HOMEPATH%\gOEYMkgs\jwwW.exe
%TEMP%\WER4169.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\pMoU.exe
%HOMEPATH%\gOEYMkgs\iUQI.exe
%HOMEPATH%\gOEYMkgs\HoUi.exe
%HOMEPATH%\gOEYMkgs\tAAE.exe
%HOMEPATH%\gOEYMkgs\DkIS.exe
%HOMEPATH%\gOEYMkgs\wwcE.exe
%HOMEPATH%\gOEYMkgs\VYYi.exe
%HOMEPATH%\gOEYMkgs\FAwI.exe
%HOMEPATH%\gOEYMkgs\CYMc.exe
%HOMEPATH%\gOEYMkgs\QUEu.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\bAQo.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\MkQw.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\wsEy.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%HOMEPATH%\gOEYMkgs\OAIo.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%TEMP%\WERcabf.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\TYEm.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\ukcq.exe
%HOMEPATH%\gOEYMkgs\gQkC.exe
%HOMEPATH%\gOEYMkgs\FAIU.exe
%HOMEPATH%\gOEYMkgs\psYk.exe
%HOMEPATH%\gOEYMkgs\SsIu.exe
%HOMEPATH%\gOEYMkgs\IkAK.exe
%HOMEPATH%\gOEYMkgs\xwAw.exe
%HOMEPATH%\gOEYMkgs\XoYU.exe
%TEMP%\WERcabf.dir00\ZgMYMIIE.exe.hdmp
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\PAIq.exe
%HOMEPATH%\gOEYMkgs\OAwK.exe
%TEMP%\WERcabf.dir00\manifest.txt
%TEMP%\WERcabf.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\gMUC.exe

Deletes the following files:

%HOMEPATH%\gOEYMkgs\cYkm.exe
%HOMEPATH%\gOEYMkgs\CYos.exe
%HOMEPATH%\gOEYMkgs\XEoe.exe
%HOMEPATH%\gOEYMkgs\aAMO.exe
%HOMEPATH%\gOEYMkgs\QEsw.exe
%HOMEPATH%\gOEYMkgs\XUMW.exe
%HOMEPATH%\gOEYMkgs\fMkQ.exe
%HOMEPATH%\gOEYMkgs\owAU.exe
%HOMEPATH%\gOEYMkgs\mcMY.exe
%HOMEPATH%\gOEYMkgs\yEwO.exe
%HOMEPATH%\gOEYMkgs\IAcG.exe
%HOMEPATH%\gOEYMkgs\ZEwe.exe
%HOMEPATH%\gOEYMkgs\wwoW.exe
%HOMEPATH%\gOEYMkgs\wUUm.exe
%HOMEPATH%\gOEYMkgs\dkMA.exe
%HOMEPATH%\gOEYMkgs\icMA.exe
%HOMEPATH%\gOEYMkgs\JQQM.exe
%HOMEPATH%\gOEYMkgs\mIcW.exe
%HOMEPATH%\gOEYMkgs\HQIW.exe
%HOMEPATH%\gOEYMkgs\TEkI.exe
%HOMEPATH%\gOEYMkgs\tMIw.exe
%HOMEPATH%\gOEYMkgs\bYwI.exe
%HOMEPATH%\gOEYMkgs\kQAy.exe
%HOMEPATH%\gOEYMkgs\wsoU.exe
%HOMEPATH%\gOEYMkgs\RwgO.exe
%HOMEPATH%\gOEYMkgs\uIQo.exe
%HOMEPATH%\gOEYMkgs\Ocko.exe
%HOMEPATH%\gOEYMkgs\HQcm.exe
%HOMEPATH%\gOEYMkgs\lMEo.exe
%HOMEPATH%\gOEYMkgs\uggK.exe
%HOMEPATH%\gOEYMkgs\ngkU.exe
%HOMEPATH%\gOEYMkgs\YsMW.exe
%HOMEPATH%\gOEYMkgs\BMQQ.exe
%HOMEPATH%\gOEYMkgs\jssi.exe
%HOMEPATH%\gOEYMkgs\qggm.exe
%HOMEPATH%\gOEYMkgs\EYcA.exe
%HOMEPATH%\gOEYMkgs\TIAQ.exe
%HOMEPATH%\gOEYMkgs\eQoM.exe
%HOMEPATH%\gOEYMkgs\XEIk.exe
%HOMEPATH%\gOEYMkgs\ZcQe.exe
%HOMEPATH%\gOEYMkgs\WAIO.exe
%HOMEPATH%\gOEYMkgs\LYEK.exe
%HOMEPATH%\gOEYMkgs\CgwY.exe
%HOMEPATH%\gOEYMkgs\awQE.exe
%HOMEPATH%\gOEYMkgs\YMcW.exe
%HOMEPATH%\gOEYMkgs\lYAG.exe
%HOMEPATH%\gOEYMkgs\iIMQ.exe
%HOMEPATH%\gOEYMkgs\lUIo.exe
%HOMEPATH%\gOEYMkgs\cUwC.exe
%HOMEPATH%\gOEYMkgs\RQwe.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
%HOMEPATH%\gOEYMkgs\EwwM.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize
%HOMEPATH%\gOEYMkgs\eocM.exe
%HOMEPATH%\gOEYMkgs\Wocc.exe
%HOMEPATH%\gOEYMkgs\yQEe.exe
%HOMEPATH%\gOEYMkgs\rccw.exe
%HOMEPATH%\gOEYMkgs\WQcQ.exe
%HOMEPATH%\gOEYMkgs\lMYA.exe
%HOMEPATH%\gOEYMkgs\uYco.exe
%HOMEPATH%\gOEYMkgs\eEgQ.exe
%HOMEPATH%\gOEYMkgs\ZAcQ.exe
%HOMEPATH%\gOEYMkgs\kQws.exe
%HOMEPATH%\gOEYMkgs\eoEy.exe
%HOMEPATH%\gOEYMkgs\oUMk.exe
%HOMEPATH%\gOEYMkgs\YscK.exe
%HOMEPATH%\gOEYMkgs\AYIM.exe
%HOMEPATH%\gOEYMkgs\jQoK.exe
%HOMEPATH%\gOEYMkgs\FMUk.exe
%HOMEPATH%\gOEYMkgs\nAUy.exe
%HOMEPATH%\gOEYMkgs\HIcc.exe
%HOMEPATH%\gOEYMkgs\VwQg.exe
%HOMEPATH%\gOEYMkgs\iowE.exe
%HOMEPATH%\gOEYMkgs\qIIE.exe
%HOMEPATH%\gOEYMkgs\ukcq.exe
%HOMEPATH%\gOEYMkgs\OAIo.exe
%HOMEPATH%\gOEYMkgs\bAQo.exe
%HOMEPATH%\gOEYMkgs\TYEm.exe
%HOMEPATH%\gOEYMkgs\tMwy.exe
%TEMP%\TMgwUQwE.bat
%HOMEPATH%\gOEYMkgs\ZEEQ.exe
%HOMEPATH%\gOEYMkgs\FwwS.exe
%HOMEPATH%\gOEYMkgs\fQUI.exe
%HOMEPATH%\gOEYMkgs\MkQw.exe
%HOMEPATH%\gOEYMkgs\gQkC.exe
%HOMEPATH%\gOEYMkgs\FAIU.exe
%HOMEPATH%\gOEYMkgs\XoYU.exe
%HOMEPATH%\gOEYMkgs\SsIu.exe
%HOMEPATH%\gOEYMkgs\psYk.exe
%HOMEPATH%\gOEYMkgs\PAIq.exe
%HOMEPATH%\gOEYMkgs\wsEy.exe
%HOMEPATH%\gOEYMkgs\gMUC.exe
%HOMEPATH%\gOEYMkgs\OAwK.exe
%HOMEPATH%\gOEYMkgs\sQgE.exe
%HOMEPATH%\gOEYMkgs\GQAw.exe
%HOMEPATH%\gOEYMkgs\mgUg.exe
%HOMEPATH%\gOEYMkgs\NggI.exe
%HOMEPATH%\gOEYMkgs\zgoA.exe
%HOMEPATH%\gOEYMkgs\KQIg.exe
%HOMEPATH%\gOEYMkgs\ykcG.exe
%HOMEPATH%\gOEYMkgs\KkQy.exe
%HOMEPATH%\gOEYMkgs\booa.exe
%HOMEPATH%\gOEYMkgs\xoEQ.exe
%HOMEPATH%\gOEYMkgs\hQoa.exe
%HOMEPATH%\gOEYMkgs\ZsAQ.exe
%HOMEPATH%\gOEYMkgs\vgQw.exe
%HOMEPATH%\gOEYMkgs\SkYC.exe
%HOMEPATH%\gOEYMkgs\OgEY.exe
%HOMEPATH%\gOEYMkgs\Esog.exe
%HOMEPATH%\gOEYMkgs\Mcci.exe
%HOMEPATH%\gOEYMkgs\LcIc.exe
%HOMEPATH%\gOEYMkgs\qwou.exe
%HOMEPATH%\gOEYMkgs\kwse.exe
%HOMEPATH%\gOEYMkgs\xwAw.exe
%HOMEPATH%\gOEYMkgs\jwwW.exe
%HOMEPATH%\gOEYMkgs\nAAA.exe
%HOMEPATH%\gOEYMkgs\pMoU.exe
%HOMEPATH%\gOEYMkgs\iUQI.exe
%HOMEPATH%\gOEYMkgs\YMgy.exe
%HOMEPATH%\gOEYMkgs\FAwI.exe
%HOMEPATH%\gOEYMkgs\CYMc.exe
%HOMEPATH%\gOEYMkgs\awQa.exe
%HOMEPATH%\gOEYMkgs\VYYi.exe
%HOMEPATH%\gOEYMkgs\vwYe.exe
%HOMEPATH%\gOEYMkgs\aAQu.exe
%HOMEPATH%\gOEYMkgs\YUgw.exe
%HOMEPATH%\gOEYMkgs\wYoA.exe
%HOMEPATH%\gOEYMkgs\EYIM.exe
%HOMEPATH%\gOEYMkgs\LAgq.exe
%HOMEPATH%\gOEYMkgs\gQMe.exe
%HOMEPATH%\gOEYMkgs\vkIe.exe
%HOMEPATH%\gOEYMkgs\OwgI.exe
%HOMEPATH%\gOEYMkgs\PEMe.exe
%HOMEPATH%\gOEYMkgs\wwcE.exe
%HOMEPATH%\gOEYMkgs\QwEK.exe
%HOMEPATH%\gOEYMkgs\voYM.exe
%HOMEPATH%\gOEYMkgs\iUck.exe
%HOMEPATH%\gOEYMkgs\TYwa.exe
%HOMEPATH%\gOEYMkgs\WsAg.exe
%HOMEPATH%\gOEYMkgs\QUEu.exe
%HOMEPATH%\gOEYMkgs\IkAK.exe
%HOMEPATH%\gOEYMkgs\rUks.exe
%HOMEPATH%\gOEYMkgs\FcYS.exe
%HOMEPATH%\gOEYMkgs\yMgo.exe
%HOMEPATH%\gOEYMkgs\DkIS.exe
%HOMEPATH%\gOEYMkgs\iUEq.exe
%HOMEPATH%\gOEYMkgs\HoUi.exe
%HOMEPATH%\gOEYMkgs\tAAE.exe
%HOMEPATH%\gOEYMkgs\uIEM.exe
%HOMEPATH%\gOEYMkgs\GgAW.exe
%HOMEPATH%\gOEYMkgs\GIUi.exe
%HOMEPATH%\gOEYMkgs\zkMI.exe
%HOMEPATH%\gOEYMkgs\NMEI.exe

Network activity:

Connects to:

'74.##5.232.51':443
'ap#.###coincharts.com':443
'74.##5.232.51':80

TCP:

HTTP GET requests:

http:/// via 74.##5.232.51
http://google.com/ via 74.##5.232.51

UDP:

DNS ASK ma##.google.com
DNS ASK ap#.###coincharts.com
DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Run'
ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Open'
ClassName: 'WorkerW' WindowName: ''
ClassName: 'DV2ControlHost' WindowName: ''
ClassName: 'BUTTON' WindowName: 'START'
ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'xSMgIcIg'
ClassName: '' WindowName: 'Windows Internet Explorer'
ClassName: '' WindowName: 'Open File'
ClassName: 'Shell_TrayWnd' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial