Trojan.DownLoader25.16293

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Infects the following executable files:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Executes the following:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

Modifies file system:

Creates the following files:

%HOMEPATH%\gOEYMkgs\QwMi.exe
%HOMEPATH%\gOEYMkgs\qMMA.exe
%HOMEPATH%\gOEYMkgs\Kwcm.exe
%HOMEPATH%\gOEYMkgs\OoYU.exe
%HOMEPATH%\gOEYMkgs\pocK.exe
%HOMEPATH%\gOEYMkgs\nssM.exe
%HOMEPATH%\gOEYMkgs\UMoy.exe
%HOMEPATH%\gOEYMkgs\JUgI.exe
%HOMEPATH%\gOEYMkgs\NgEC.exe
%HOMEPATH%\gOEYMkgs\nIoo.exe
%HOMEPATH%\gOEYMkgs\vQsG.exe
%HOMEPATH%\gOEYMkgs\tQoM.exe
%HOMEPATH%\gOEYMkgs\YIEa.exe
%HOMEPATH%\gOEYMkgs\QgUW.exe
%HOMEPATH%\gOEYMkgs\kIkG.exe
%HOMEPATH%\gOEYMkgs\iEIg.exe
%HOMEPATH%\gOEYMkgs\XcsY.exe
%HOMEPATH%\gOEYMkgs\Tgci.exe
%HOMEPATH%\gOEYMkgs\esMk.exe
%HOMEPATH%\gOEYMkgs\qYEa.exe
%HOMEPATH%\gOEYMkgs\rwIS.exe
%HOMEPATH%\gOEYMkgs\PIEu.exe
%HOMEPATH%\gOEYMkgs\GEAc.exe
%HOMEPATH%\gOEYMkgs\gkkO.exe
%HOMEPATH%\gOEYMkgs\kYYq.exe
%HOMEPATH%\gOEYMkgs\kUAW.exe
%HOMEPATH%\gOEYMkgs\CAgW.exe
%HOMEPATH%\gOEYMkgs\kcAa.exe
%HOMEPATH%\gOEYMkgs\lEwE.exe
%TEMP%\WER831b.dir00\manifest.txt
%TEMP%\WER831b.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\IsME.exe
%HOMEPATH%\gOEYMkgs\bwwM.exe
%TEMP%\WER831b.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\wssO.exe
%HOMEPATH%\gOEYMkgs\yoAg.exe
%TEMP%\WER831b.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\yIwO.exe
%HOMEPATH%\gOEYMkgs\dQEw.exe
%HOMEPATH%\gOEYMkgs\wAAs.exe
%HOMEPATH%\gOEYMkgs\oYAu.exe
%HOMEPATH%\gOEYMkgs\dYsW.exe
%HOMEPATH%\gOEYMkgs\LgYc.exe
%HOMEPATH%\gOEYMkgs\cggG.exe
%HOMEPATH%\gOEYMkgs\jQYw.exe
%HOMEPATH%\gOEYMkgs\UsUS.exe
%HOMEPATH%\gOEYMkgs\kYwc.exe
%HOMEPATH%\gOEYMkgs\DsUU.exe
%HOMEPATH%\gOEYMkgs\EkMU.exe
%HOMEPATH%\gOEYMkgs\jAIk.exe
%HOMEPATH%\gOEYMkgs\HEse.exe
%HOMEPATH%\gOEYMkgs\ZcIG.exe
%HOMEPATH%\gOEYMkgs\ugkM.exe
%HOMEPATH%\gOEYMkgs\MIYg.exe
%HOMEPATH%\gOEYMkgs\VAQa.exe
%HOMEPATH%\gOEYMkgs\HQgY.exe
%HOMEPATH%\gOEYMkgs\nYgi.exe
%HOMEPATH%\gOEYMkgs\pcsK.exe
%HOMEPATH%\gOEYMkgs\JYEY.exe
%HOMEPATH%\gOEYMkgs\EscM.exe
%HOMEPATH%\gOEYMkgs\yEQs.exe
%HOMEPATH%\gOEYMkgs\fcQk.exe
%HOMEPATH%\gOEYMkgs\sMMs.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%HOMEPATH%\gOEYMkgs\SkYg.exe
%HOMEPATH%\gOEYMkgs\WUAs.exe
%HOMEPATH%\gOEYMkgs\FkUY.exe
%HOMEPATH%\gOEYMkgs\VsAE.exe
%HOMEPATH%\gOEYMkgs\zEAQ.exe
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
%HOMEPATH%\gOEYMkgs\xgIk.exe
%HOMEPATH%\gOEYMkgs\YYAI.exe
%HOMEPATH%\gOEYMkgs\Tgku.exe
%HOMEPATH%\gOEYMkgs\sEgo.exe
%HOMEPATH%\gOEYMkgs\Jgcw.exe
%HOMEPATH%\gOEYMkgs\FAQG.exe
%HOMEPATH%\gOEYMkgs\FIUm.exe
%HOMEPATH%\gOEYMkgs\wcgS.exe
%HOMEPATH%\gOEYMkgs\RUMo.exe
%TEMP%\WERfa10.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\iQgO.exe
%HOMEPATH%\gOEYMkgs\CsIq.exe
%HOMEPATH%\gOEYMkgs\qwYO.exe
%HOMEPATH%\gOEYMkgs\gYIk.exe
%HOMEPATH%\gOEYMkgs\hUcS.exe
%HOMEPATH%\gOEYMkgs\tIsY.exe
%HOMEPATH%\gOEYMkgs\lUoc.exe
%HOMEPATH%\gOEYMkgs\uQwO.exe
%HOMEPATH%\gOEYMkgs\ncoS.exe
%HOMEPATH%\gOEYMkgs\AssC.exe
%HOMEPATH%\gOEYMkgs\OcMu.exe
%HOMEPATH%\gOEYMkgs\fEwm.exe
%HOMEPATH%\gOEYMkgs\RIQk.exe
%HOMEPATH%\gOEYMkgs\hIwy.exe
%HOMEPATH%\gOEYMkgs\oooa.exe
%HOMEPATH%\gOEYMkgs\YkYM.exe
%HOMEPATH%\gOEYMkgs\oMEg.exe
%HOMEPATH%\gOEYMkgs\tsUG.exe
%HOMEPATH%\gOEYMkgs\pcwA.exe
%HOMEPATH%\gOEYMkgs\SUUo.exe
%HOMEPATH%\gOEYMkgs\zkYK.exe
%TEMP%\WERfa10.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\LoEe.exe
%TEMP%\WERfa10.dir00\manifest.txt
%TEMP%\WERfa10.dir00\appcompat.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\vsYK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\vksg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\KUQs.exe
%HOMEPATH%\gOEYMkgs\VMQm.exe
%HOMEPATH%\gOEYMkgs\MkMO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\YQAI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\KQEO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\EYsW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\Zsok.exe
%HOMEPATH%\gOEYMkgs\fwsS.exe
<Current directory>\<File name>
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\XoEY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\IQgC.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\WAoy.exe
%TEMP%\WER27fe.dir00\manifest.txt
%TEMP%\WER27fe.dir00\appcompat.txt
%TEMP%\WER27fe.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\AMkQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\pUwk.exe
%TEMP%\WER27fe.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\ZcAm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\RMsQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%HOMEPATH%\gOEYMkgs\mEwi.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\UYMO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\EYIC.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\AkcS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\ocMe.exe
%HOMEPATH%\gOEYMkgs\aIMI.exe
%HOMEPATH%\gOEYMkgs\WEcW.exe
%HOMEPATH%\gOEYMkgs\XYMY.exe
%HOMEPATH%\gOEYMkgs\DIYu.exe
%HOMEPATH%\gOEYMkgs\rskO.exe
%HOMEPATH%\gOEYMkgs\ycMu.exe
%TEMP%\WER1595.dir00\manifest.txt
%TEMP%\WER1595.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\DsEy.exe
%HOMEPATH%\gOEYMkgs\SkUc.exe
%HOMEPATH%\gOEYMkgs\ZcAS.exe
%HOMEPATH%\gOEYMkgs\DcoS.exe
%HOMEPATH%\gOEYMkgs\dQsC.exe
%HOMEPATH%\gOEYMkgs\dwYw.exe
%HOMEPATH%\gOEYMkgs\kgcq.exe
%HOMEPATH%\gOEYMkgs\lIwC.exe
%HOMEPATH%\gOEYMkgs\HAsq.exe
%HOMEPATH%\gOEYMkgs\pcAy.exe
%HOMEPATH%\gOEYMkgs\uQYE.exe
%HOMEPATH%\gOEYMkgs\Pgko.exe
%HOMEPATH%\gOEYMkgs\ecEy.exe
%HOMEPATH%\gOEYMkgs\tUoO.exe
%HOMEPATH%\gOEYMkgs\yUso.exe
%HOMEPATH%\gOEYMkgs\PMkm.exe
%HOMEPATH%\gOEYMkgs\agwS.exe
%TEMP%\WERa552.dir00\manifest.txt
%TEMP%\WERa552.dir00\appcompat.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\TwUs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%HOMEPATH%\gOEYMkgs\bsMS.exe
%HOMEPATH%\gOEYMkgs\uwUI.exe
%TEMP%\WERa552.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\Qkga.exe
%TEMP%\WERa552.dir00\ZgMYMIIE.exe.hdmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\XcQy.exe
%HOMEPATH%\gOEYMkgs\usgI.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\MIII.exe
%TEMP%\WER1595.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER1595.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\rgYs.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\BcUA.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\tgkk.exe

Deletes the following files:

%HOMEPATH%\gOEYMkgs\esMk.exe
%HOMEPATH%\gOEYMkgs\QgUW.exe
%HOMEPATH%\gOEYMkgs\XcsY.exe
%HOMEPATH%\gOEYMkgs\Tgci.exe
%HOMEPATH%\gOEYMkgs\kIkG.exe
%HOMEPATH%\gOEYMkgs\gkkO.exe
%HOMEPATH%\gOEYMkgs\kYYq.exe
%HOMEPATH%\gOEYMkgs\iEIg.exe
%HOMEPATH%\gOEYMkgs\qYEa.exe
%HOMEPATH%\gOEYMkgs\AssC.exe
%HOMEPATH%\gOEYMkgs\OcMu.exe
%HOMEPATH%\gOEYMkgs\CsIq.exe
%HOMEPATH%\gOEYMkgs\tIsY.exe
%HOMEPATH%\gOEYMkgs\fEwm.exe
%HOMEPATH%\gOEYMkgs\ncoS.exe
%HOMEPATH%\gOEYMkgs\ugkM.exe
%HOMEPATH%\gOEYMkgs\lUoc.exe
%HOMEPATH%\gOEYMkgs\uQwO.exe
%HOMEPATH%\gOEYMkgs\kUAW.exe
%HOMEPATH%\gOEYMkgs\tQoM.exe
%HOMEPATH%\gOEYMkgs\YIEa.exe
%HOMEPATH%\gOEYMkgs\UMoy.exe
%HOMEPATH%\gOEYMkgs\vQsG.exe
%HOMEPATH%\gOEYMkgs\JUgI.exe
%HOMEPATH%\gOEYMkgs\LgYc.exe
%HOMEPATH%\gOEYMkgs\cggG.exe
%HOMEPATH%\gOEYMkgs\NgEC.exe
%HOMEPATH%\gOEYMkgs\nIoo.exe
%HOMEPATH%\gOEYMkgs\GEAc.exe
%HOMEPATH%\gOEYMkgs\OoYU.exe
%HOMEPATH%\gOEYMkgs\rwIS.exe
%HOMEPATH%\gOEYMkgs\PIEu.exe
%HOMEPATH%\gOEYMkgs\pocK.exe
%HOMEPATH%\gOEYMkgs\qMMA.exe
%HOMEPATH%\gOEYMkgs\Kwcm.exe
%HOMEPATH%\gOEYMkgs\nssM.exe
%HOMEPATH%\gOEYMkgs\QwMi.exe
%HOMEPATH%\gOEYMkgs\iQgO.exe
%HOMEPATH%\gOEYMkgs\FAQG.exe
%HOMEPATH%\gOEYMkgs\nYgi.exe
%HOMEPATH%\gOEYMkgs\sEgo.exe
%HOMEPATH%\gOEYMkgs\Jgcw.exe
%HOMEPATH%\gOEYMkgs\pcsK.exe
%HOMEPATH%\gOEYMkgs\VAQa.exe
%HOMEPATH%\gOEYMkgs\HQgY.exe
%HOMEPATH%\gOEYMkgs\JYEY.exe
%HOMEPATH%\gOEYMkgs\MIYg.exe
%HOMEPATH%\gOEYMkgs\FkUY.exe
%HOMEPATH%\gOEYMkgs\VsAE.exe
%HOMEPATH%\gOEYMkgs\xgIk.exe
%HOMEPATH%\gOEYMkgs\YYAI.exe
%HOMEPATH%\gOEYMkgs\zEAQ.exe
%HOMEPATH%\gOEYMkgs\wcgS.exe
%HOMEPATH%\gOEYMkgs\RUMo.exe
%HOMEPATH%\gOEYMkgs\Tgku.exe
%HOMEPATH%\gOEYMkgs\FIUm.exe
%HOMEPATH%\gOEYMkgs\EscM.exe
%HOMEPATH%\gOEYMkgs\pcwA.exe
%HOMEPATH%\gOEYMkgs\LoEe.exe
%HOMEPATH%\gOEYMkgs\hIwy.exe
%HOMEPATH%\gOEYMkgs\oooa.exe
%HOMEPATH%\gOEYMkgs\SUUo.exe
%HOMEPATH%\gOEYMkgs\gYIk.exe
%HOMEPATH%\gOEYMkgs\hUcS.exe
%HOMEPATH%\gOEYMkgs\zkYK.exe
%HOMEPATH%\gOEYMkgs\qwYO.exe
%HOMEPATH%\gOEYMkgs\yEQs.exe
%HOMEPATH%\gOEYMkgs\fcQk.exe
%HOMEPATH%\gOEYMkgs\SkYg.exe
%HOMEPATH%\gOEYMkgs\WUAs.exe
%HOMEPATH%\gOEYMkgs\sMMs.exe
%HOMEPATH%\gOEYMkgs\tsUG.exe
%HOMEPATH%\gOEYMkgs\RIQk.exe
%HOMEPATH%\gOEYMkgs\YkYM.exe
%HOMEPATH%\gOEYMkgs\oMEg.exe
%HOMEPATH%\gOEYMkgs\jQYw.exe
%HOMEPATH%\gOEYMkgs\bsMS.exe
%HOMEPATH%\gOEYMkgs\uwUI.exe
%HOMEPATH%\gOEYMkgs\rgYs.exe
%HOMEPATH%\gOEYMkgs\TwUs.exe
%HOMEPATH%\gOEYMkgs\XcQy.exe
%TEMP%\hycIEIgs.bat
%HOMEPATH%\gOEYMkgs\EYsW.exe
%HOMEPATH%\gOEYMkgs\Qkga.exe
%HOMEPATH%\gOEYMkgs\fwsS.exe
%HOMEPATH%\gOEYMkgs\ZcAS.exe
%HOMEPATH%\gOEYMkgs\DcoS.exe
%HOMEPATH%\gOEYMkgs\ycMu.exe
%HOMEPATH%\gOEYMkgs\SkUc.exe
%HOMEPATH%\gOEYMkgs\DsEy.exe
%HOMEPATH%\gOEYMkgs\BcUA.exe
%HOMEPATH%\gOEYMkgs\tgkk.exe
%HOMEPATH%\gOEYMkgs\usgI.exe
%HOMEPATH%\gOEYMkgs\MIII.exe
%HOMEPATH%\gOEYMkgs\Zsok.exe
%HOMEPATH%\gOEYMkgs\ZcAm.exe
%HOMEPATH%\gOEYMkgs\RMsQ.exe
%HOMEPATH%\gOEYMkgs\YQAI.exe
%HOMEPATH%\gOEYMkgs\mEwi.exe
%HOMEPATH%\gOEYMkgs\EYIC.exe
%HOMEPATH%\gOEYMkgs\AMkQ.exe
%HOMEPATH%\gOEYMkgs\pUwk.exe
%HOMEPATH%\gOEYMkgs\AkcS.exe
%HOMEPATH%\gOEYMkgs\UYMO.exe
%HOMEPATH%\gOEYMkgs\XoEY.exe
%HOMEPATH%\gOEYMkgs\vksg.exe
%HOMEPATH%\gOEYMkgs\IQgC.exe
%HOMEPATH%\gOEYMkgs\WAoy.exe
%HOMEPATH%\gOEYMkgs\KUQs.exe
%HOMEPATH%\gOEYMkgs\KQEO.exe
%HOMEPATH%\gOEYMkgs\MkMO.exe
%HOMEPATH%\gOEYMkgs\vsYK.exe
%HOMEPATH%\gOEYMkgs\VMQm.exe
%HOMEPATH%\gOEYMkgs\WEcW.exe
%HOMEPATH%\gOEYMkgs\CAgW.exe
%HOMEPATH%\gOEYMkgs\kcAa.exe
%HOMEPATH%\gOEYMkgs\EkMU.exe
%HOMEPATH%\gOEYMkgs\IsME.exe
%HOMEPATH%\gOEYMkgs\lEwE.exe
%HOMEPATH%\gOEYMkgs\dQEw.exe
%HOMEPATH%\gOEYMkgs\wssO.exe
%HOMEPATH%\gOEYMkgs\bwwM.exe
%HOMEPATH%\gOEYMkgs\yIwO.exe
%HOMEPATH%\gOEYMkgs\dYsW.exe
%HOMEPATH%\gOEYMkgs\UsUS.exe
%HOMEPATH%\gOEYMkgs\wAAs.exe
%HOMEPATH%\gOEYMkgs\oYAu.exe
%HOMEPATH%\gOEYMkgs\jAIk.exe
%HOMEPATH%\gOEYMkgs\kYwc.exe
%HOMEPATH%\gOEYMkgs\DsUU.exe
%HOMEPATH%\gOEYMkgs\HEse.exe
%HOMEPATH%\gOEYMkgs\ZcIG.exe
%HOMEPATH%\gOEYMkgs\yoAg.exe
%HOMEPATH%\gOEYMkgs\ecEy.exe
%HOMEPATH%\gOEYMkgs\tUoO.exe
%HOMEPATH%\gOEYMkgs\agwS.exe
%HOMEPATH%\gOEYMkgs\Pgko.exe
%HOMEPATH%\gOEYMkgs\XYMY.exe
%HOMEPATH%\gOEYMkgs\ocMe.exe
%HOMEPATH%\gOEYMkgs\aIMI.exe
%HOMEPATH%\gOEYMkgs\DIYu.exe
%HOMEPATH%\gOEYMkgs\rskO.exe
%HOMEPATH%\gOEYMkgs\pcAy.exe
%HOMEPATH%\gOEYMkgs\dQsC.exe
%HOMEPATH%\gOEYMkgs\lIwC.exe
%HOMEPATH%\gOEYMkgs\HAsq.exe
%HOMEPATH%\gOEYMkgs\dwYw.exe
%HOMEPATH%\gOEYMkgs\yUso.exe
%HOMEPATH%\gOEYMkgs\PMkm.exe
%HOMEPATH%\gOEYMkgs\kgcq.exe
%HOMEPATH%\gOEYMkgs\uQYE.exe

Deletes itself.

Network activity:

Connects to:

'74.##5.232.51':443
'ap#.###coincharts.com':443
'74.##5.232.51':80

TCP:

HTTP GET requests:

http://google.com/ via 74.##5.232.51
http:/// via 74.##5.232.51

UDP:

DNS ASK ma##.google.com
DNS ASK ap#.###coincharts.com
DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Run'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: '' WindowName: 'Open'
ClassName: 'WorkerW' WindowName: ''
ClassName: 'DV2ControlHost' WindowName: ''
ClassName: 'BUTTON' WindowName: 'START'
ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'xSMgIcIg'
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Windows Internet Explorer'
ClassName: '' WindowName: 'Open File'

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial