Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
- C:\Far2\Far.exe
- hidden files
- file extensions
- User Account Control (UAC)
- <Current directory>\CiYU.ico
- <Current directory>\VgsY.exe
- C:\RCX3B.tmp
- <Current directory>\ZqMY.ico
- <Current directory>\JEsm.exe
- C:\RCX3D.tmp
- <Current directory>\Tcos.ico
- <Current directory>\AEoI.exe
- C:\RCX3C.tmp
- <Current directory>\JOYQ.ico
- C:\RCX3A.tmp
- <Current directory>\KkIW.exe
- C:\RCX38.tmp
- <Current directory>\rwAE.ico
- <Current directory>\acIa.exe
- C:\RCX37.tmp
- <Current directory>\MwMI.ico
- <Current directory>\tQMs.exe
- C:\RCX39.tmp
- <Current directory>\AGsM.ico
- <Current directory>\vwMi.exe
- <Current directory>\ngsS.exe
- <Current directory>\wgkW.exe
- C:\RCX43.tmp
- <Current directory>\NAwU.ico
- <Current directory>\GIoW.exe
- C:\RCX42.tmp
- <Current directory>\GGoI.ico
- <Current directory>\IIca.exe
- C:\RCX44.tmp
- <Current directory>\gQAE.ico
- <Current directory>\fkwY.exe
- <Current directory>\Ewck.ico
- C:\RCX3F.tmp
- <Current directory>\wecw.ico
- <Current directory>\Lskk.exe
- C:\RCX3E.tmp
- <Current directory>\PWww.ico
- <Current directory>\EEgM.exe
- C:\RCX41.tmp
- <Current directory>\GYsc.ico
- <Current directory>\eYou.exe
- C:\RCX40.tmp
- <Current directory>\yMAc.exe
- C:\RCX2E.tmp
- <Current directory>\HoMg.ico
- C:\RCX2D.tmp
- <STUBS_DIR>\AVPCC\AVPCC.EXE.exe
- C:\RCX2F.tmp
- <STUBS_DIR>\AVSYNMGR\AVSYNMGR.EXE.exe
- <Current directory>\DkIk.exe
- <STUBS_DIR>\AVPM\AVPM.EXE.exe
- <Current directory>\ioMw.ico
- <Current directory>\vEgc.exe
- C:\RCX2B.tmp
- <STUBS_DIR>\AVP\AVP.EXE.exe
- <Current directory>\VgIO.exe
- <STUBS_DIR>\AVGCTRL\AVGCTRL.EXE.exe
- <Current directory>\SIsA.ico
- <STUBS_DIR>\AVP32\AVP32.EXE.exe
- <Current directory>\uSYY.ico
- C:\RCX2C.tmp
- <Current directory>\TUEE.ico
- <Current directory>\PQAo.exe
- <Current directory>\Akkw.ico
- <Current directory>\FSwE.ico
- <Current directory>\KwIa.exe
- C:\RCX34.tmp
- <Current directory>\vgEw.ico
- <Current directory>\UkoI.exe
- C:\RCX36.tmp
- <Current directory>\fqoc.ico
- <Current directory>\igAg.exe
- C:\RCX35.tmp
- <Current directory>\dGoI.ico
- C:\RCX33.tmp
- <Current directory>\AkQE.exe
- C:\RCX31.tmp
- <Current directory>\eSoY.ico
- <Current directory>\QgYQ.exe
- C:\RCX30.tmp
- <Current directory>\qMkk.ico
- <Current directory>\bUMK.exe
- C:\RCX32.tmp
- <Current directory>\sCAA.ico
- <Current directory>\LIgI.exe
- C:\RCX58.tmp
- <STUBS_DIR>\GUARD\GUARD.EXE.exe
- <Current directory>\yEMQ.exe
- C:\RCX57.tmp
- <Current directory>\dogc.ico
- <Current directory>\sMwE.ico
- <Current directory>\dAUc.exe
- C:\RCX59.tmp
- <Current directory>\MKQA.ico
- <Current directory>\fEUc.exe
- <Current directory>\TEgG.exe
- <Current directory>\ragM.ico
- <Current directory>\ZYcs.exe
- C:\RCX54.tmp
- <Current directory>\vUwI.ico
- <Current directory>\XQII.exe
- C:\RCX56.tmp
- <Current directory>\rwws.ico
- <Current directory>\ogsC.exe
- C:\RCX55.tmp
- <Current directory>\vukU.ico
- C:\RCX5A.tmp
- C:\RCX5F.tmp
- <Current directory>\KeEw.ico
- <Current directory>\VocM.exe
- C:\RCX5E.tmp
- <Current directory>\ecgs.ico
- <Current directory>\dsAE.exe
- C:\RCX61.tmp
- <Current directory>\OOos.ico
- <Current directory>\Ygom.exe
- C:\RCX60.tmp
- <Current directory>\EYsG.exe
- <Current directory>\iCUk.ico
- <Current directory>\cgci.exe
- C:\RCX5B.tmp
- <Current directory>\IsUY.ico
- <Current directory>\vwQi.exe
- C:\RCX5D.tmp
- <Current directory>\jKkM.ico
- <Current directory>\TAMo.exe
- C:\RCX5C.tmp
- <Current directory>\LswA.ico
- <Current directory>\XsgG.exe
- C:\RCX4A.tmp
- <Current directory>\SMss.ico
- <Current directory>\aQQe.exe
- C:\RCX49.tmp
- <Current directory>\uSkI.ico
- <Current directory>\RgAy.exe
- C:\RCX4B.tmp
- <Current directory>\rqYY.ico
- <Current directory>\kAQS.exe
- <Current directory>\KQQk.ico
- C:\RCX46.tmp
- <Current directory>\RAMo.ico
- <Current directory>\CMMa.exe
- C:\RCX45.tmp
- <Current directory>\lWco.ico
- <Current directory>\nAUY.exe
- C:\RCX48.tmp
- <Current directory>\lSEw.ico
- <Current directory>\DskE.exe
- C:\RCX47.tmp
- C:\RCX4C.tmp
- C:\RCX51.tmp
- <Current directory>\cioc.ico
- <Current directory>\lgAO.exe
- C:\RCX50.tmp
- <Current directory>\GYcQ.ico
- <Current directory>\YEIM.exe
- C:\RCX53.tmp
- <Current directory>\SOoU.ico
- <Current directory>\DYEs.exe
- C:\RCX52.tmp
- <Current directory>\SsEI.exe
- <Current directory>\BKgI.ico
- <Current directory>\sUoC.exe
- C:\RCX4D.tmp
- <Current directory>\XAoI.ico
- <Current directory>\osgE.exe
- C:\RCX4F.tmp
- <Current directory>\LIYQ.ico
- <Current directory>\kYMI.exe
- C:\RCX4E.tmp
- <Current directory>\nMMg.ico
- C:\RCX2A.tmp
- <Current directory>\hQgu.exe
- C:\RCXC.tmp
- <Current directory>\iSgA.ico
- C:\RCXB.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- C:\RCXD.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- <Current directory>\akMy.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- <Current directory>\nqgk.ico
- <Current directory>\swYw.exe
- C:\RCX9.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- <Current directory>\BsAU.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- <Current directory>\bEYw.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- <Current directory>\oukY.ico
- C:\RCXA.tmp
- <Current directory>\wMoA.ico
- <Current directory>\YgIm.exe
- <Current directory>\Ouwg.ico
- <Current directory>\TwMK.exe
- C:\RCX11.tmp
- <Current directory>\MIgo.ico
- C:\RCX10.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- C:\RCX12.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- <Current directory>\VgYe.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- <Current directory>\riwc.ico
- <Current directory>\qMkC.exe
- <Current directory>\HWwQ.ico
- <Current directory>\fggW.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- <Current directory>\SQUc.exe
- C:\RCXE.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- <Current directory>\TEAE.ico
- %TEMP%\iKwM.vbs
- C:\RCXF.tmp
- %TEMP%\eMYccMko.bat
- <Current directory>\wkoe.exe
- C:\RCX1.tmp
- <Current directory>\<File name>
- C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
- %TEMP%\oocAMkgc.bat
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- <Current directory>\kyMc.ico
- C:\RCX2.tmp
- <Current directory>\IyME.ico
- <Current directory>\SYcq.exe
- <Current directory>\TYYE.ico
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- <Current directory>\<File name>GQVI
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %ALLUSERSPROFILE%\caQc.txt
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIENRTH
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYwsCOUK
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %HOMEPATH%\gOEYMkgs\SSIkQYgQBLQV
- <Current directory>\jscI.exe
- <Current directory>\kUIw.ico
- <Current directory>\PIQo.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- <Current directory>\fQEO.exe
- C:\RCX6.tmp
- <Current directory>\nYse.exe
- C:\RCX8.tmp
- <Current directory>\OMoU.ico
- C:\RCX7.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- <Current directory>\wcgw.ico
- <Current directory>\FEQa.exe
- C:\RCX4.tmp
- <Current directory>\fQYY.ico
- C:\RCX3.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- C:\RCX5.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- <Current directory>\kcEy.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- <Current directory>\SMww.ico
- <Current directory>\BIUs.exe
- C:\RCX21.tmp
- <Current directory>\KQYM.ico
- C:\RCX20.tmp
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- <Current directory>\eAQY.ico
- <Current directory>\jUcg.exe
- C:\RCX22.tmp
- <Current directory>\TeYg.ico
- <Current directory>\dYkI.exe
- <Current directory>\rgoU.exe
- C:\RCX1E.tmp
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- <Current directory>\VAcC.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- <Current directory>\bKgM.ico
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- <Current directory>\cOgg.ico
- C:\RCX1F.tmp
- <Current directory>\doQc.ico
- <Current directory>\WMce.exe
- C:\RCX23.tmp
- C:\RCX28.tmp
- <Current directory>\Cyss.ico
- <Current directory>\ssIS.exe
- C:\RCX27.tmp
- <Current directory>\qYwo.ico
- <Current directory>\TKYs.ico
- <Current directory>\iUkw.exe
- <STUBS_DIR>\AVGCC32\AVGCC32.EXE.exe
- <Current directory>\rAsO.exe
- C:\RCX29.tmp
- <Current directory>\vQUe.exe
- <Current directory>\iKEo.ico
- <Current directory>\mMka.exe
- C:\RCX24.tmp
- <Current directory>\sGsE.ico
- <Current directory>\BcsU.exe
- C:\RCX26.tmp
- <Current directory>\PmQg.ico
- <Current directory>\hocc.exe
- C:\RCX25.tmp
- <Current directory>\EEoI.ico
- C:\RCX16.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- <Current directory>\dEAm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- <Current directory>\mwMw.ico
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- <Current directory>\EgAI.ico
- C:\RCX17.tmp
- <Current directory>\FigA.ico
- <Current directory>\OgAY.exe
- C:\RCX15.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- <Current directory>\PyQA.ico
- C:\RCX13.tmp
- <Current directory>\kqAo.ico
- <Current directory>\KUow.exe
- <Current directory>\yyIA.ico
- <Current directory>\BYwO.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- <Current directory>\bowQ.exe
- C:\RCX14.tmp
- <Current directory>\fIAA.exe
- <Current directory>\bqks.ico
- <Current directory>\OIQi.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- <Current directory>\iQki.exe
- C:\RCX1B.tmp
- <Current directory>\tEss.exe
- C:\RCX1D.tmp
- <Current directory>\MiEw.ico
- C:\RCX1C.tmp
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- <Current directory>\KQQo.ico
- <Current directory>\SQMw.exe
- C:\RCX19.tmp
- <Current directory>\WcQI.ico
- C:\RCX18.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- C:\RCX1A.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- <Current directory>\kwwQ.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- <Current directory>\Qqks.ico
- <Current directory>\wecw.ico
- <Current directory>\eYou.exe
- <Current directory>\PWww.ico
- <Current directory>\GIoW.exe
- <Current directory>\GYsc.ico
- <Current directory>\EEgM.exe
- <Current directory>\JOYQ.ico
- <Current directory>\AEoI.exe
- <Current directory>\CiYU.ico
- <Current directory>\Lskk.exe
- <Current directory>\Tcos.ico
- <Current directory>\ngsS.exe
- <Current directory>\lWco.ico
- <Current directory>\CMMa.exe
- <Current directory>\GGoI.ico
- <Current directory>\nAUY.exe
- <Current directory>\RAMo.ico
- <Current directory>\DskE.exe
- <Current directory>\NAwU.ico
- <Current directory>\wgkW.exe
- <Current directory>\Ewck.ico
- <Current directory>\IIca.exe
- <Current directory>\gQAE.ico
- <Current directory>\fkwY.exe
- <Current directory>\VgsY.exe
- <Current directory>\UkoI.exe
- <Current directory>\qMkk.ico
- <Current directory>\bUMK.exe
- <Current directory>\FSwE.ico
- <Current directory>\KwIa.exe
- <Current directory>\vgEw.ico
- <Current directory>\AkQE.exe
- <Current directory>\Akkw.ico
- <Current directory>\QgYQ.exe
- <Current directory>\sCAA.ico
- <Current directory>\LIgI.exe
- <Current directory>\eSoY.ico
- <Current directory>\tQMs.exe
- <Current directory>\AGsM.ico
- <Current directory>\vwMi.exe
- <Current directory>\ZqMY.ico
- <Current directory>\JEsm.exe
- <Current directory>\MwMI.ico
- <Current directory>\acIa.exe
- <Current directory>\dGoI.ico
- <Current directory>\igAg.exe
- <Current directory>\rwAE.ico
- <Current directory>\KkIW.exe
- <Current directory>\fqoc.ico
- <Current directory>\fEUc.exe
- <Current directory>\dogc.ico
- <Current directory>\yEMQ.exe
- <Current directory>\sMwE.ico
- <Current directory>\dAUc.exe
- <Current directory>\MKQA.ico
- <Current directory>\ogsC.exe
- <Current directory>\ragM.ico
- <Current directory>\ZYcs.exe
- <Current directory>\rwws.ico
- <Current directory>\TEgG.exe
- <Current directory>\vukU.ico
- <Current directory>\VocM.exe
- <Current directory>\jKkM.ico
- <Current directory>\EYsG.exe
- <Current directory>\KeEw.ico
- <Current directory>\Ygom.exe
- <Current directory>\ecgs.ico
- <Current directory>\cgci.exe
- <Current directory>\IsUY.ico
- <Current directory>\vwQi.exe
- <Current directory>\LswA.ico
- <Current directory>\TAMo.exe
- <Current directory>\iCUk.ico
- <Current directory>\vUwI.ico
- <Current directory>\uSkI.ico
- <Current directory>\RgAy.exe
- <Current directory>\rqYY.ico
- <Current directory>\sUoC.exe
- <Current directory>\XAoI.ico
- <Current directory>\osgE.exe
- <Current directory>\KQQk.ico
- <Current directory>\aQQe.exe
- <Current directory>\lSEw.ico
- <Current directory>\kAQS.exe
- <Current directory>\SMss.ico
- <Current directory>\XsgG.exe
- <Current directory>\cioc.ico
- <Current directory>\DYEs.exe
- <Current directory>\GYcQ.ico
- <Current directory>\XQII.exe
- <Current directory>\SOoU.ico
- <Current directory>\YEIM.exe
- <Current directory>\nMMg.ico
- <Current directory>\kYMI.exe
- <Current directory>\BKgI.ico
- <Current directory>\lgAO.exe
- <Current directory>\LIYQ.ico
- <Current directory>\SsEI.exe
- <Current directory>\ioMw.ico
- <Current directory>\fggW.exe
- <Current directory>\Ouwg.ico
- <Current directory>\SQUc.exe
- <Current directory>\TEAE.ico
- <Current directory>\qMkC.exe
- <Current directory>\HWwQ.ico
- <Current directory>\hQgu.exe
- <Current directory>\oukY.ico
- <Current directory>\swYw.exe
- <Current directory>\nqgk.ico
- <Current directory>\akMy.exe
- <Current directory>\iSgA.ico
- <Current directory>\BYwO.exe
- <Current directory>\PyQA.ico
- <Current directory>\bowQ.exe
- <Current directory>\mwMw.ico
- <Current directory>\dEAm.exe
- <Current directory>\yyIA.ico
- <Current directory>\VgYe.exe
- <Current directory>\MIgo.ico
- <Current directory>\TwMK.exe
- <Current directory>\kqAo.ico
- <Current directory>\KUow.exe
- <Current directory>\riwc.ico
- <Current directory>\wMoA.ico
- <Current directory>\IyME.ico
- <Current directory>\SYcq.exe
- <Current directory>\TYYE.ico
- <Current directory>\FEQa.exe
- <Current directory>\kyMc.ico
- <Current directory>\jscI.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYwsCOUK
- %HOMEPATH%\gOEYMkgs\SSIkQYgQBLQV
- <Current directory>\<File name>GQVI
- <Current directory>\wkoe.exe
- %TEMP%\oocAMkgc.bat
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIENRTH
- <Current directory>\OMoU.ico
- <Current directory>\nYse.exe
- <Current directory>\kUIw.ico
- <Current directory>\YgIm.exe
- <Current directory>\bEYw.ico
- <Current directory>\BsAU.exe
- <Current directory>\SMww.ico
- <Current directory>\kcEy.exe
- <Current directory>\fQYY.ico
- <Current directory>\PIQo.exe
- <Current directory>\wcgw.ico
- <Current directory>\fQEO.exe
- <Current directory>\PmQg.ico
- <Current directory>\vQUe.exe
- <Current directory>\EEoI.ico
- <Current directory>\rAsO.exe
- <Current directory>\qYwo.ico
- <Current directory>\ssIS.exe
- <Current directory>\sGsE.ico
- <Current directory>\BcsU.exe
- <Current directory>\eAQY.ico
- <Current directory>\hocc.exe
- <Current directory>\iKEo.ico
- <Current directory>\mMka.exe
- <Current directory>\uSYY.ico
- <Current directory>\vEgc.exe
- <Current directory>\TUEE.ico
- <Current directory>\DkIk.exe
- <Current directory>\HoMg.ico
- <Current directory>\yMAc.exe
- <Current directory>\TKYs.ico
- <Current directory>\iUkw.exe
- <Current directory>\Cyss.ico
- <Current directory>\PQAo.exe
- <Current directory>\SIsA.ico
- <Current directory>\VgIO.exe
- <Current directory>\jUcg.exe
- <Current directory>\iQki.exe
- <Current directory>\Qqks.ico
- <Current directory>\kwwQ.exe
- <Current directory>\bqks.ico
- <Current directory>\OIQi.exe
- <Current directory>\KQQo.ico
- <Current directory>\fIAA.exe
- <Current directory>\FigA.ico
- <Current directory>\OgAY.exe
- <Current directory>\WcQI.ico
- <Current directory>\SQMw.exe
- <Current directory>\EgAI.ico
- <Current directory>\BIUs.exe
- <Current directory>\cOgg.ico
- <Current directory>\rgoU.exe
- <Current directory>\TeYg.ico
- <Current directory>\dYkI.exe
- <Current directory>\KQYM.ico
- <Current directory>\VAcC.exe
- <Current directory>\MiEw.ico
- <Current directory>\tEss.exe
- <Current directory>\doQc.ico
- <Current directory>\WMce.exe
- <Current directory>\bKgM.ico
- <Current directory>\eYou.exe
- <Current directory>\EEgM.exe
- <Current directory>\GIoW.exe
- <Current directory>\AEoI.exe
- <Current directory>\ngsS.exe
- <Current directory>\Lskk.exe
- <Current directory>\CMMa.exe
- <Current directory>\DskE.exe
- <Current directory>\nAUY.exe
- <Current directory>\wgkW.exe
- <Current directory>\fkwY.exe
- <Current directory>\IIca.exe
- <Current directory>\UkoI.exe
- <Current directory>\KwIa.exe
- <Current directory>\igAg.exe
- <Current directory>\AkQE.exe
- <Current directory>\LIgI.exe
- <Current directory>\bUMK.exe
- <Current directory>\tQMs.exe
- <Current directory>\JEsm.exe
- <Current directory>\VgsY.exe
- <Current directory>\acIa.exe
- <Current directory>\KkIW.exe
- <Current directory>\vwMi.exe
- <Current directory>\yEMQ.exe
- <Current directory>\fEUc.exe
- <Current directory>\dAUc.exe
- <Current directory>\ZYcs.exe
- <Current directory>\ogsC.exe
- <Current directory>\TEgG.exe
- <Current directory>\EYsG.exe
- <Current directory>\VocM.exe
- <Current directory>\Ygom.exe
- <Current directory>\vwQi.exe
- <Current directory>\cgci.exe
- <Current directory>\TAMo.exe
- <Current directory>\RgAy.exe
- <Current directory>\osgE.exe
- <Current directory>\sUoC.exe
- <Current directory>\aQQe.exe
- <Current directory>\XsgG.exe
- <Current directory>\kAQS.exe
- <Current directory>\DYEs.exe
- <Current directory>\YEIM.exe
- <Current directory>\XQII.exe
- <Current directory>\kYMI.exe
- <Current directory>\SsEI.exe
- <Current directory>\lgAO.exe
- <Current directory>\QgYQ.exe
- <Current directory>\fggW.exe
- <Current directory>\qMkC.exe
- <Current directory>\TwMK.exe
- <Current directory>\hQgu.exe
- <Current directory>\akMy.exe
- <Current directory>\SQUc.exe
- <Current directory>\BYwO.exe
- <Current directory>\dEAm.exe
- <Current directory>\OgAY.exe
- <Current directory>\VgYe.exe
- <Current directory>\KUow.exe
- <Current directory>\bowQ.exe
- <Current directory>\jscI.exe
- <Current directory>\FEQa.exe
- <Current directory>\kcEy.exe
- <Current directory>\<File name>GQVI
- <Current directory>\wkoe.exe
- <Current directory>\SYcq.exe
- <Current directory>\BsAU.exe
- <Current directory>\YgIm.exe
- <Current directory>\swYw.exe
- <Current directory>\fQEO.exe
- <Current directory>\PIQo.exe
- <Current directory>\nYse.exe
- <Current directory>\vQUe.exe
- <Current directory>\ssIS.exe
- <Current directory>\rAsO.exe
- <Current directory>\BcsU.exe
- <Current directory>\mMka.exe
- <Current directory>\hocc.exe
- <Current directory>\vEgc.exe
- <Current directory>\yMAc.exe
- <Current directory>\DkIk.exe
- <Current directory>\iUkw.exe
- <Current directory>\VgIO.exe
- <Current directory>\PQAo.exe
- <Current directory>\iQki.exe
- <Current directory>\OIQi.exe
- <Current directory>\tEss.exe
- <Current directory>\fIAA.exe
- <Current directory>\SQMw.exe
- <Current directory>\kwwQ.exe
- <Current directory>\BIUs.exe
- <Current directory>\dYkI.exe
- <Current directory>\jUcg.exe
- <Current directory>\VAcC.exe
- <Current directory>\WMce.exe
- <Current directory>\rgoU.exe
- '74.##5.232.51':80
- http://google.com/ via 74.##5.232.51
- DNS ASK google.com
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- '<SYSTEM32>\cscript.exe' %TEMP%\iKwM.vbs
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '<Full path to file>'
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\eMYccMko.bat" "<Full path to file>""
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1