Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
- <STUBS_DIR>\test.exe
- C:\Far2\Far.exe
- hidden files
- file extensions
- User Account Control (UAC)
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- %HOMEPATH%\gOEYMkgs\zsYC.exe
- %HOMEPATH%\gOEYMkgs\gsIA.exe
- %HOMEPATH%\gOEYMkgs\YMUA.exe
- %HOMEPATH%\gOEYMkgs\lgIY.exe
- %HOMEPATH%\gOEYMkgs\oIUA.exe
- %HOMEPATH%\gOEYMkgs\powK.exe
- %HOMEPATH%\gOEYMkgs\tcUU.exe
- %HOMEPATH%\gOEYMkgs\WYgQ.exe
- %HOMEPATH%\gOEYMkgs\rQok.exe
- %HOMEPATH%\gOEYMkgs\DoQA.exe
- %HOMEPATH%\gOEYMkgs\PYca.exe
- %HOMEPATH%\gOEYMkgs\cgIU.exe
- %HOMEPATH%\gOEYMkgs\hoAk.exe
- %HOMEPATH%\gOEYMkgs\KQUS.exe
- %HOMEPATH%\gOEYMkgs\IIQi.exe
- %HOMEPATH%\gOEYMkgs\zMQO.exe
- %HOMEPATH%\gOEYMkgs\xwIE.exe
- %HOMEPATH%\gOEYMkgs\VQYw.exe
- %HOMEPATH%\gOEYMkgs\CYYK.exe
- %HOMEPATH%\gOEYMkgs\oAcM.exe
- %HOMEPATH%\gOEYMkgs\LsgI.exe
- %HOMEPATH%\gOEYMkgs\FsIU.exe
- %HOMEPATH%\gOEYMkgs\pMwS.exe
- %HOMEPATH%\gOEYMkgs\GUkC.exe
- %HOMEPATH%\gOEYMkgs\GsoS.exe
- %HOMEPATH%\gOEYMkgs\hEME.exe
- %TEMP%\WER789c.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\rQwY.exe
- %HOMEPATH%\gOEYMkgs\dQYI.exe
- %HOMEPATH%\gOEYMkgs\uAwq.exe
- %HOMEPATH%\gOEYMkgs\VkAI.exe
- %HOMEPATH%\gOEYMkgs\dYkO.exe
- %HOMEPATH%\gOEYMkgs\kwsE.exe
- %HOMEPATH%\gOEYMkgs\JccM.exe
- %HOMEPATH%\gOEYMkgs\iUky.exe
- %HOMEPATH%\gOEYMkgs\LIow.exe
- %HOMEPATH%\gOEYMkgs\DEAu.exe
- %HOMEPATH%\gOEYMkgs\ygIG.exe
- %HOMEPATH%\gOEYMkgs\qgEE.exe
- %HOMEPATH%\gOEYMkgs\Gwck.exe
- %HOMEPATH%\gOEYMkgs\xoIy.exe
- %HOMEPATH%\gOEYMkgs\roUO.exe
- %HOMEPATH%\gOEYMkgs\vEwK.exe
- %HOMEPATH%\gOEYMkgs\LMEs.exe
- %HOMEPATH%\gOEYMkgs\tEQe.exe
- %HOMEPATH%\gOEYMkgs\vQIA.exe
- %TEMP%\WER789c.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\PIsu.exe
- %TEMP%\WER789c.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\TcMQ.exe
- %TEMP%\WER789c.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\DcgQ.exe
- %HOMEPATH%\gOEYMkgs\HYAG.exe
- %HOMEPATH%\gOEYMkgs\DIcu.exe
- %HOMEPATH%\gOEYMkgs\HwEy.exe
- %HOMEPATH%\gOEYMkgs\loQc.exe
- %HOMEPATH%\gOEYMkgs\NsMs.exe
- %HOMEPATH%\gOEYMkgs\zcUM.exe
- %HOMEPATH%\gOEYMkgs\Soos.exe
- %HOMEPATH%\gOEYMkgs\bgsu.exe
- %HOMEPATH%\gOEYMkgs\esMA.exe
- C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
- %HOMEPATH%\gOEYMkgs\LMEM.exe
- %HOMEPATH%\gOEYMkgs\qUEE.exe
- %HOMEPATH%\gOEYMkgs\RMYM.exe
- %HOMEPATH%\gOEYMkgs\eQUO.exe
- %HOMEPATH%\gOEYMkgs\wogs.exe
- %HOMEPATH%\gOEYMkgs\ZAIY.exe
- %HOMEPATH%\gOEYMkgs\GAMg.exe
- %HOMEPATH%\gOEYMkgs\IAUW.exe
- %HOMEPATH%\gOEYMkgs\ywcy.exe
- %HOMEPATH%\gOEYMkgs\agEe.exe
- %HOMEPATH%\gOEYMkgs\qIQK.exe
- %HOMEPATH%\gOEYMkgs\zMwm.exe
- %HOMEPATH%\gOEYMkgs\JsUw.exe
- %HOMEPATH%\gOEYMkgs\yUUu.exe
- %HOMEPATH%\gOEYMkgs\gsga.exe
- %HOMEPATH%\gOEYMkgs\ysgK.exe
- %HOMEPATH%\gOEYMkgs\pYQU.exe
- %HOMEPATH%\gOEYMkgs\bwYG.exe
- %HOMEPATH%\gOEYMkgs\eQEU.exe
- %HOMEPATH%\gOEYMkgs\Mksc.exe
- %HOMEPATH%\gOEYMkgs\lwco.exe
- %HOMEPATH%\gOEYMkgs\TAgc.exe
- %HOMEPATH%\gOEYMkgs\GIgA.exe
- %HOMEPATH%\gOEYMkgs\oAQU.exe
- %HOMEPATH%\gOEYMkgs\aUMk.exe
- %HOMEPATH%\gOEYMkgs\uUYW.exe
- %HOMEPATH%\gOEYMkgs\psIC.exe
- %HOMEPATH%\gOEYMkgs\AIEI.exe
- %HOMEPATH%\gOEYMkgs\CEQE.exe
- %HOMEPATH%\gOEYMkgs\iIIA.exe
- %HOMEPATH%\gOEYMkgs\lYUC.exe
- %HOMEPATH%\gOEYMkgs\BAkI.exe
- %HOMEPATH%\gOEYMkgs\WwEm.exe
- %HOMEPATH%\gOEYMkgs\xkss.exe
- %HOMEPATH%\gOEYMkgs\RAwY.exe
- %HOMEPATH%\gOEYMkgs\DYAC.exe
- %HOMEPATH%\gOEYMkgs\MkMu.exe
- %HOMEPATH%\gOEYMkgs\VMEE.exe
- %HOMEPATH%\gOEYMkgs\ygQQ.exe
- %HOMEPATH%\gOEYMkgs\TYEg.exe
- %HOMEPATH%\gOEYMkgs\awIs.exe
- %HOMEPATH%\gOEYMkgs\GgUI.exe
- %HOMEPATH%\gOEYMkgs\PUws.exe
- %HOMEPATH%\gOEYMkgs\PcAy.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %HOMEPATH%\gOEYMkgs\lwsS.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %HOMEPATH%\gOEYMkgs\DcMY.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %TEMP%\WER188f.dir00\manifest.txt
- %TEMP%\WER188f.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\Gsgc.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %HOMEPATH%\gOEYMkgs\hcwE.exe
- %TEMP%\WER965e.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\BUoa.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %TEMP%\WER965e.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\SEYs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %HOMEPATH%\gOEYMkgs\ywUs.exe
- %HOMEPATH%\gOEYMkgs\bkEE.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %HOMEPATH%\gOEYMkgs\FkwO.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %HOMEPATH%\gOEYMkgs\XwYE.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %ALLUSERSPROFILE%\caQc.txt
- %TEMP%\WERa0c2.dir00\manifest.txt
- %TEMP%\WERa0c2.dir00\appcompat.txt
- <Current directory>\<File name>
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %HOMEPATH%\gOEYMkgs\FkAw.exe
- %TEMP%\WERa0c2.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %TEMP%\WERa0c2.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %TEMP%\WER188f.dir00\ZgMYMIIE.exe.hdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %HOMEPATH%\gOEYMkgs\Ckwq.exe
- %HOMEPATH%\gOEYMkgs\ZwsG.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %HOMEPATH%\gOEYMkgs\CIAs.exe
- %TEMP%\WER188f.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\ucYk.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %HOMEPATH%\gOEYMkgs\eUgK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %HOMEPATH%\gOEYMkgs\TMAM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %HOMEPATH%\gOEYMkgs\HoUk.exe
- %TEMP%\WER02f4.dir00\manifest.txt
- %TEMP%\WER02f4.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\pMoo.exe
- %HOMEPATH%\gOEYMkgs\dEoQ.exe
- %HOMEPATH%\gOEYMkgs\pgoa.exe
- %HOMEPATH%\gOEYMkgs\VAsW.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %HOMEPATH%\gOEYMkgs\PwAI.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %TEMP%\WER02f4.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\lsgw.exe
- %TEMP%\WER02f4.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\NcMQ.exe
- %HOMEPATH%\gOEYMkgs\jEIC.exe
- %HOMEPATH%\gOEYMkgs\KIoq.exe
- %HOMEPATH%\gOEYMkgs\MMgs.exe
- %HOMEPATH%\gOEYMkgs\qssU.exe
- %HOMEPATH%\gOEYMkgs\yIsA.exe
- %HOMEPATH%\gOEYMkgs\tMgO.exe
- %HOMEPATH%\gOEYMkgs\eooE.exe
- %HOMEPATH%\gOEYMkgs\oYYU.exe
- %HOMEPATH%\gOEYMkgs\CgYI.exe
- %HOMEPATH%\gOEYMkgs\BQMI.exe
- %HOMEPATH%\gOEYMkgs\yosa.exe
- %HOMEPATH%\gOEYMkgs\tsQM.exe
- %HOMEPATH%\gOEYMkgs\bgQC.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\MIke.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %HOMEPATH%\gOEYMkgs\RUIC.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %HOMEPATH%\gOEYMkgs\HAwM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %TEMP%\WER965e.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\UoUC.exe
- %TEMP%\WER965e.dir00\appcompat.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %HOMEPATH%\gOEYMkgs\UYAe.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %HOMEPATH%\gOEYMkgs\yMos.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %HOMEPATH%\gOEYMkgs\gcoO.exe
- %HOMEPATH%\gOEYMkgs\XsEY.exe
- %HOMEPATH%\gOEYMkgs\pMEM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\KcwI.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %HOMEPATH%\gOEYMkgs\TYsM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %HOMEPATH%\gOEYMkgs\aUMk.exe
- %HOMEPATH%\gOEYMkgs\uUYW.exe
- %HOMEPATH%\gOEYMkgs\CEQE.exe
- %HOMEPATH%\gOEYMkgs\oAQU.exe
- %HOMEPATH%\gOEYMkgs\xwIE.exe
- %HOMEPATH%\gOEYMkgs\KQUS.exe
- %HOMEPATH%\gOEYMkgs\IIQi.exe
- %HOMEPATH%\gOEYMkgs\VQYw.exe
- %HOMEPATH%\gOEYMkgs\CYYK.exe
- %HOMEPATH%\gOEYMkgs\TAgc.exe
- %HOMEPATH%\gOEYMkgs\pYQU.exe
- %HOMEPATH%\gOEYMkgs\Mksc.exe
- %HOMEPATH%\gOEYMkgs\lwco.exe
- %HOMEPATH%\gOEYMkgs\bwYG.exe
- %HOMEPATH%\gOEYMkgs\psIC.exe
- %HOMEPATH%\gOEYMkgs\AIEI.exe
- %HOMEPATH%\gOEYMkgs\eQEU.exe
- %HOMEPATH%\gOEYMkgs\GIgA.exe
- %HOMEPATH%\gOEYMkgs\zMQO.exe
- %HOMEPATH%\gOEYMkgs\gsIA.exe
- %HOMEPATH%\gOEYMkgs\YMUA.exe
- %HOMEPATH%\gOEYMkgs\powK.exe
- %HOMEPATH%\gOEYMkgs\zsYC.exe
- %HOMEPATH%\gOEYMkgs\tcUU.exe
- %HOMEPATH%\gOEYMkgs\hoAk.exe
- %HOMEPATH%\gOEYMkgs\WYgQ.exe
- %HOMEPATH%\gOEYMkgs\PYca.exe
- %HOMEPATH%\gOEYMkgs\cgIU.exe
- %HOMEPATH%\gOEYMkgs\GsoS.exe
- %HOMEPATH%\gOEYMkgs\hEME.exe
- %HOMEPATH%\gOEYMkgs\oAcM.exe
- %HOMEPATH%\gOEYMkgs\GUkC.exe
- %HOMEPATH%\gOEYMkgs\LsgI.exe
- %HOMEPATH%\gOEYMkgs\lgIY.exe
- %HOMEPATH%\gOEYMkgs\oIUA.exe
- %HOMEPATH%\gOEYMkgs\FsIU.exe
- %HOMEPATH%\gOEYMkgs\pMwS.exe
- %HOMEPATH%\gOEYMkgs\ygQQ.exe
- %HOMEPATH%\gOEYMkgs\zMwm.exe
- %HOMEPATH%\gOEYMkgs\JsUw.exe
- %HOMEPATH%\gOEYMkgs\ysgK.exe
- %HOMEPATH%\gOEYMkgs\qIQK.exe
- %HOMEPATH%\gOEYMkgs\loQc.exe
- %HOMEPATH%\gOEYMkgs\HYAG.exe
- %HOMEPATH%\gOEYMkgs\DIcu.exe
- %HOMEPATH%\gOEYMkgs\NsMs.exe
- %HOMEPATH%\gOEYMkgs\zcUM.exe
- %HOMEPATH%\gOEYMkgs\ywcy.exe
- %HOMEPATH%\gOEYMkgs\eQUO.exe
- %HOMEPATH%\gOEYMkgs\GAMg.exe
- %HOMEPATH%\gOEYMkgs\IAUW.exe
- %HOMEPATH%\gOEYMkgs\wogs.exe
- %HOMEPATH%\gOEYMkgs\yUUu.exe
- %HOMEPATH%\gOEYMkgs\gsga.exe
- %HOMEPATH%\gOEYMkgs\ZAIY.exe
- %HOMEPATH%\gOEYMkgs\agEe.exe
- %HOMEPATH%\gOEYMkgs\HwEy.exe
- %HOMEPATH%\gOEYMkgs\BAkI.exe
- %HOMEPATH%\gOEYMkgs\DYAC.exe
- %HOMEPATH%\gOEYMkgs\iIIA.exe
- %HOMEPATH%\gOEYMkgs\lYUC.exe
- %HOMEPATH%\gOEYMkgs\TYEg.exe
- %HOMEPATH%\gOEYMkgs\MkMu.exe
- %HOMEPATH%\gOEYMkgs\VMEE.exe
- %HOMEPATH%\gOEYMkgs\awIs.exe
- %HOMEPATH%\gOEYMkgs\GgUI.exe
- %HOMEPATH%\gOEYMkgs\qUEE.exe
- %HOMEPATH%\gOEYMkgs\RMYM.exe
- %HOMEPATH%\gOEYMkgs\Soos.exe
- %HOMEPATH%\gOEYMkgs\LMEM.exe
- %HOMEPATH%\gOEYMkgs\bgsu.exe
- %HOMEPATH%\gOEYMkgs\xkss.exe
- %HOMEPATH%\gOEYMkgs\RAwY.exe
- %HOMEPATH%\gOEYMkgs\esMA.exe
- %HOMEPATH%\gOEYMkgs\WwEm.exe
- %HOMEPATH%\gOEYMkgs\rQok.exe
- %HOMEPATH%\gOEYMkgs\pMEM.exe
- %HOMEPATH%\gOEYMkgs\KcwI.exe
- %HOMEPATH%\gOEYMkgs\XsEY.exe
- %HOMEPATH%\gOEYMkgs\TYsM.exe
- %HOMEPATH%\gOEYMkgs\RUIC.exe
- %HOMEPATH%\gOEYMkgs\UoUC.exe
- %HOMEPATH%\gOEYMkgs\HAwM.exe
- %HOMEPATH%\gOEYMkgs\bgQC.exe
- %HOMEPATH%\gOEYMkgs\MIke.exe
- %HOMEPATH%\gOEYMkgs\HoUk.exe
- %HOMEPATH%\gOEYMkgs\VAsW.exe
- %HOMEPATH%\gOEYMkgs\dEoQ.exe
- %HOMEPATH%\gOEYMkgs\pgoa.exe
- %HOMEPATH%\gOEYMkgs\lsgw.exe
- %HOMEPATH%\gOEYMkgs\gcoO.exe
- %HOMEPATH%\gOEYMkgs\UYAe.exe
- %HOMEPATH%\gOEYMkgs\PwAI.exe
- %HOMEPATH%\gOEYMkgs\yMos.exe
- %HOMEPATH%\gOEYMkgs\SEYs.exe
- %HOMEPATH%\gOEYMkgs\CIAs.exe
- %HOMEPATH%\gOEYMkgs\Ckwq.exe
- %HOMEPATH%\gOEYMkgs\hcwE.exe
- %HOMEPATH%\gOEYMkgs\ZwsG.exe
- %HOMEPATH%\gOEYMkgs\TMAM.exe
- %TEMP%\kUYMQkEA.bat
- %HOMEPATH%\gOEYMkgs\FkAw.exe
- %HOMEPATH%\gOEYMkgs\ucYk.exe
- %HOMEPATH%\gOEYMkgs\eUgK.exe
- %HOMEPATH%\gOEYMkgs\XwYE.exe
- %HOMEPATH%\gOEYMkgs\bkEE.exe
- %HOMEPATH%\gOEYMkgs\BUoa.exe
- %HOMEPATH%\gOEYMkgs\ywUs.exe
- %HOMEPATH%\gOEYMkgs\FkwO.exe
- %HOMEPATH%\gOEYMkgs\lwsS.exe
- %HOMEPATH%\gOEYMkgs\Gsgc.exe
- %HOMEPATH%\gOEYMkgs\DcMY.exe
- %HOMEPATH%\gOEYMkgs\PcAy.exe
- %HOMEPATH%\gOEYMkgs\pMoo.exe
- %HOMEPATH%\gOEYMkgs\uAwq.exe
- %HOMEPATH%\gOEYMkgs\VkAI.exe
- %HOMEPATH%\gOEYMkgs\DcgQ.exe
- %HOMEPATH%\gOEYMkgs\PIsu.exe
- %HOMEPATH%\gOEYMkgs\dYkO.exe
- %HOMEPATH%\gOEYMkgs\kwsE.exe
- %HOMEPATH%\gOEYMkgs\DEAu.exe
- %HOMEPATH%\gOEYMkgs\rQwY.exe
- %HOMEPATH%\gOEYMkgs\dQYI.exe
- %HOMEPATH%\gOEYMkgs\LMEs.exe
- %HOMEPATH%\gOEYMkgs\tEQe.exe
- %HOMEPATH%\gOEYMkgs\DoQA.exe
- %HOMEPATH%\gOEYMkgs\vEwK.exe
- %HOMEPATH%\gOEYMkgs\Gwck.exe
- %HOMEPATH%\gOEYMkgs\vQIA.exe
- %HOMEPATH%\gOEYMkgs\TcMQ.exe
- %HOMEPATH%\gOEYMkgs\xoIy.exe
- %HOMEPATH%\gOEYMkgs\roUO.exe
- %HOMEPATH%\gOEYMkgs\ygIG.exe
- %HOMEPATH%\gOEYMkgs\tMgO.exe
- %HOMEPATH%\gOEYMkgs\BQMI.exe
- %HOMEPATH%\gOEYMkgs\jEIC.exe
- %HOMEPATH%\gOEYMkgs\KIoq.exe
- %HOMEPATH%\gOEYMkgs\yosa.exe
- %HOMEPATH%\gOEYMkgs\oYYU.exe
- %HOMEPATH%\gOEYMkgs\CgYI.exe
- %HOMEPATH%\gOEYMkgs\tsQM.exe
- %HOMEPATH%\gOEYMkgs\eooE.exe
- %HOMEPATH%\gOEYMkgs\iUky.exe
- %HOMEPATH%\gOEYMkgs\LIow.exe
- %HOMEPATH%\gOEYMkgs\qgEE.exe
- %HOMEPATH%\gOEYMkgs\JccM.exe
- %HOMEPATH%\gOEYMkgs\PUws.exe
- %HOMEPATH%\gOEYMkgs\yIsA.exe
- %HOMEPATH%\gOEYMkgs\NcMQ.exe
- %HOMEPATH%\gOEYMkgs\MMgs.exe
- %HOMEPATH%\gOEYMkgs\qssU.exe
- '74.##5.232.51':80
- http://google.com/ via 74.##5.232.51
- http:/// via 74.##5.232.51
- DNS ASK google.com
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'lacMcYws.exe'