Trojan.DownLoader25.16472

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Infects the following executable files:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Executes the following:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

Modifies file system:

Creates the following files:

%HOMEPATH%\gOEYMkgs\CUgW.exe
%HOMEPATH%\gOEYMkgs\pQse.exe
%HOMEPATH%\gOEYMkgs\MIgs.exe
%HOMEPATH%\gOEYMkgs\jUoE.exe
%HOMEPATH%\gOEYMkgs\DUcu.exe
%HOMEPATH%\gOEYMkgs\BQIW.exe
%HOMEPATH%\gOEYMkgs\zcsC.exe
%TEMP%\WER52a7.dir00\appcompat.txt
%HOMEPATH%\gOEYMkgs\EQIK.exe
%HOMEPATH%\gOEYMkgs\rMMI.exe
%HOMEPATH%\gOEYMkgs\aYka.exe
%TEMP%\WER52a7.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\cYcq.exe
%HOMEPATH%\gOEYMkgs\cEIU.exe
%HOMEPATH%\gOEYMkgs\aIAs.exe
%HOMEPATH%\gOEYMkgs\AQYS.exe
%HOMEPATH%\gOEYMkgs\YssK.exe
%HOMEPATH%\gOEYMkgs\WUQm.exe
%HOMEPATH%\gOEYMkgs\hEMO.exe
%HOMEPATH%\gOEYMkgs\Psog.exe
%HOMEPATH%\gOEYMkgs\aQYW.exe
%HOMEPATH%\gOEYMkgs\bEMq.exe
%HOMEPATH%\gOEYMkgs\fsoC.exe
%HOMEPATH%\gOEYMkgs\MMYW.exe
%HOMEPATH%\gOEYMkgs\hQkw.exe
%TEMP%\WER52a7.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\tsMA.exe
%HOMEPATH%\gOEYMkgs\AsAY.exe
%HOMEPATH%\gOEYMkgs\RYYC.exe
%HOMEPATH%\gOEYMkgs\ZUYA.exe
%HOMEPATH%\gOEYMkgs\tIAe.exe
%HOMEPATH%\gOEYMkgs\zEIU.exe
%HOMEPATH%\gOEYMkgs\OcIU.exe
%HOMEPATH%\gOEYMkgs\pIkS.exe
%HOMEPATH%\gOEYMkgs\xwUc.exe
%HOMEPATH%\gOEYMkgs\hAMG.exe
%HOMEPATH%\gOEYMkgs\iIUE.exe
%HOMEPATH%\gOEYMkgs\LwQs.exe
%HOMEPATH%\gOEYMkgs\fcsK.exe
%TEMP%\WER52a7.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\pMAk.exe
%HOMEPATH%\gOEYMkgs\moMc.exe
%HOMEPATH%\gOEYMkgs\UIMa.exe
%HOMEPATH%\gOEYMkgs\UoAW.exe
%HOMEPATH%\gOEYMkgs\zEYg.exe
%HOMEPATH%\gOEYMkgs\woUq.exe
%HOMEPATH%\gOEYMkgs\Eckc.exe
%HOMEPATH%\gOEYMkgs\nYAo.exe
%HOMEPATH%\gOEYMkgs\lIIw.exe
%HOMEPATH%\gOEYMkgs\TUoG.exe
%HOMEPATH%\gOEYMkgs\IMYI.exe
%HOMEPATH%\gOEYMkgs\cwsg.exe
%HOMEPATH%\gOEYMkgs\pMkm.exe
%HOMEPATH%\gOEYMkgs\Gcoo.exe
%HOMEPATH%\gOEYMkgs\QMYq.exe
%HOMEPATH%\gOEYMkgs\kgIK.exe
%HOMEPATH%\gOEYMkgs\uMsI.exe
%HOMEPATH%\gOEYMkgs\vUMO.exe
%HOMEPATH%\gOEYMkgs\WEYO.exe
%HOMEPATH%\gOEYMkgs\eMMq.exe
%HOMEPATH%\gOEYMkgs\lUcU.exe
%HOMEPATH%\gOEYMkgs\vkom.exe
%HOMEPATH%\gOEYMkgs\dYgK.exe
%HOMEPATH%\gOEYMkgs\uAcm.exe
%HOMEPATH%\gOEYMkgs\SEIG.exe
%TEMP%\WERc835.dir00\appcompat.txt
%TEMP%\WERc835.dir00\ZgMYMIIE.exe.hdmp
%HOMEPATH%\gOEYMkgs\zsQO.exe
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%TEMP%\WERc835.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\sQAg.exe
%HOMEPATH%\gOEYMkgs\JgQc.exe
%HOMEPATH%\gOEYMkgs\BUou.exe
%HOMEPATH%\gOEYMkgs\FYYW.exe
%TEMP%\WERc835.dir00\ZgMYMIIE.exe.mdmp
%HOMEPATH%\gOEYMkgs\GQsQ.exe
%HOMEPATH%\gOEYMkgs\vYYm.exe
%HOMEPATH%\gOEYMkgs\Jkca.exe
%HOMEPATH%\gOEYMkgs\mcMo.exe
%HOMEPATH%\gOEYMkgs\DUgw.exe
%HOMEPATH%\gOEYMkgs\sYAU.exe
%HOMEPATH%\gOEYMkgs\HUUc.exe
%HOMEPATH%\gOEYMkgs\OkIK.exe
%HOMEPATH%\gOEYMkgs\rYUe.exe
%HOMEPATH%\gOEYMkgs\losw.exe
%HOMEPATH%\gOEYMkgs\nMYk.exe
%HOMEPATH%\gOEYMkgs\AIEK.exe
%HOMEPATH%\gOEYMkgs\JosG.exe
%HOMEPATH%\gOEYMkgs\nwss.exe
%HOMEPATH%\gOEYMkgs\JQIi.exe
%HOMEPATH%\gOEYMkgs\xsAo.exe
%HOMEPATH%\gOEYMkgs\KwIi.exe
%HOMEPATH%\gOEYMkgs\UwUu.exe
%HOMEPATH%\gOEYMkgs\AokY.exe
%HOMEPATH%\gOEYMkgs\tsAg.exe
%HOMEPATH%\gOEYMkgs\DooM.exe
%HOMEPATH%\gOEYMkgs\AIMe.exe
%HOMEPATH%\gOEYMkgs\ZIwK.exe
%HOMEPATH%\gOEYMkgs\xsUy.exe
%HOMEPATH%\gOEYMkgs\vUYi.exe
%HOMEPATH%\gOEYMkgs\Tkkk.exe
%HOMEPATH%\gOEYMkgs\Eocc.exe
%HOMEPATH%\gOEYMkgs\EcUo.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\YcgK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\NoYY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\skIK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\qMUW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\qIsA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\UsQy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\lEkK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\ccwE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%HOMEPATH%\gOEYMkgs\xcIk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%HOMEPATH%\gOEYMkgs\HkQq.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\ZUAa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\BMIi.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%TEMP%\WER6871.dir00\appcompat.txt
%TEMP%\WER6871.dir00\ZgMYMIIE.exe.hdmp
%TEMP%\WER6871.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\YYMC.exe
%TEMP%\WER6871.dir00\manifest.txt
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\nsEe.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\BwAi.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\QIYU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%HOMEPATH%\gOEYMkgs\VYAs.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\HsMi.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\RwUy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\UggG.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\VoMY.exe
%HOMEPATH%\gOEYMkgs\vMIi.exe
%HOMEPATH%\gOEYMkgs\GMQs.exe
%HOMEPATH%\gOEYMkgs\scsO.exe
%HOMEPATH%\gOEYMkgs\oQQO.exe
%HOMEPATH%\gOEYMkgs\aYMA.exe
%HOMEPATH%\gOEYMkgs\voYO.exe
%HOMEPATH%\gOEYMkgs\ScYi.exe
%HOMEPATH%\gOEYMkgs\SkQI.exe
%HOMEPATH%\gOEYMkgs\XgYo.exe
%HOMEPATH%\gOEYMkgs\wcwc.exe
%HOMEPATH%\gOEYMkgs\UoIS.exe
%HOMEPATH%\gOEYMkgs\nQMQ.exe
%HOMEPATH%\gOEYMkgs\Usku.exe
%HOMEPATH%\gOEYMkgs\qkEM.exe
%HOMEPATH%\gOEYMkgs\mIUc.exe
%HOMEPATH%\gOEYMkgs\Wcwu.exe
%HOMEPATH%\gOEYMkgs\zocS.exe
%HOMEPATH%\gOEYMkgs\UkQS.exe
%HOMEPATH%\gOEYMkgs\gQsi.exe
%HOMEPATH%\gOEYMkgs\vIcW.exe
%HOMEPATH%\gOEYMkgs\fcYU.exe
%HOMEPATH%\gOEYMkgs\lcwe.exe
%HOMEPATH%\gOEYMkgs\NYUA.exe
%HOMEPATH%\gOEYMkgs\zskQ.exe
%HOMEPATH%\gOEYMkgs\WYEa.exe
%HOMEPATH%\gOEYMkgs\Lwsm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%HOMEPATH%\gOEYMkgs\PYEW.exe
<Current directory>\<File name>
%HOMEPATH%\gOEYMkgs\JAEo.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\rMIA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\LEIY.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\kYcq.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%TEMP%\WERe084.dir00\appcompat.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\fUQo.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\CccY.exe
%TEMP%\WERe084.dir00\manifest.txt
%TEMP%\WERe084.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\IAEw.exe
%TEMP%\WERe084.dir00\ZgMYMIIE.exe.hdmp
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%HOMEPATH%\gOEYMkgs\VosY.exe

Deletes the following files:

%HOMEPATH%\gOEYMkgs\cEIU.exe
%HOMEPATH%\gOEYMkgs\aIAs.exe
%HOMEPATH%\gOEYMkgs\WUQm.exe
%HOMEPATH%\gOEYMkgs\hEMO.exe
%HOMEPATH%\gOEYMkgs\AQYS.exe
%HOMEPATH%\gOEYMkgs\hQkw.exe
%HOMEPATH%\gOEYMkgs\Psog.exe
%HOMEPATH%\gOEYMkgs\fsoC.exe
%HOMEPATH%\gOEYMkgs\MMYW.exe
%HOMEPATH%\gOEYMkgs\JosG.exe
%HOMEPATH%\gOEYMkgs\nwss.exe
%HOMEPATH%\gOEYMkgs\DUgw.exe
%HOMEPATH%\gOEYMkgs\AIEK.exe
%HOMEPATH%\gOEYMkgs\rYUe.exe
%HOMEPATH%\gOEYMkgs\cwsg.exe
%HOMEPATH%\gOEYMkgs\YssK.exe
%HOMEPATH%\gOEYMkgs\losw.exe
%HOMEPATH%\gOEYMkgs\nMYk.exe
%HOMEPATH%\gOEYMkgs\aQYW.exe
%HOMEPATH%\gOEYMkgs\EQIK.exe
%HOMEPATH%\gOEYMkgs\UIMa.exe
%HOMEPATH%\gOEYMkgs\aYka.exe
%HOMEPATH%\gOEYMkgs\zcsC.exe
%HOMEPATH%\gOEYMkgs\UoAW.exe
%HOMEPATH%\gOEYMkgs\moMc.exe
%HOMEPATH%\gOEYMkgs\lIIw.exe
%HOMEPATH%\gOEYMkgs\zEYg.exe
%HOMEPATH%\gOEYMkgs\pMAk.exe
%HOMEPATH%\gOEYMkgs\jUoE.exe
%HOMEPATH%\gOEYMkgs\DUcu.exe
%HOMEPATH%\gOEYMkgs\bEMq.exe
%HOMEPATH%\gOEYMkgs\cYcq.exe
%HOMEPATH%\gOEYMkgs\BQIW.exe
%HOMEPATH%\gOEYMkgs\MIgs.exe
%HOMEPATH%\gOEYMkgs\rMMI.exe
%HOMEPATH%\gOEYMkgs\CUgW.exe
%HOMEPATH%\gOEYMkgs\pQse.exe
%HOMEPATH%\gOEYMkgs\mcMo.exe
%HOMEPATH%\gOEYMkgs\Gcoo.exe
%HOMEPATH%\gOEYMkgs\QMYq.exe
%HOMEPATH%\gOEYMkgs\vUMO.exe
%HOMEPATH%\gOEYMkgs\pMkm.exe
%HOMEPATH%\gOEYMkgs\vkom.exe
%HOMEPATH%\gOEYMkgs\WEYO.exe
%HOMEPATH%\gOEYMkgs\eMMq.exe
%HOMEPATH%\gOEYMkgs\dYgK.exe
%HOMEPATH%\gOEYMkgs\uAcm.exe
%HOMEPATH%\gOEYMkgs\GQsQ.exe
%HOMEPATH%\gOEYMkgs\sQAg.exe
%HOMEPATH%\gOEYMkgs\zsQO.exe
%HOMEPATH%\gOEYMkgs\FYYW.exe
%HOMEPATH%\gOEYMkgs\JgQc.exe
%HOMEPATH%\gOEYMkgs\kgIK.exe
%HOMEPATH%\gOEYMkgs\uMsI.exe
%HOMEPATH%\gOEYMkgs\BUou.exe
%HOMEPATH%\gOEYMkgs\SEIG.exe
%HOMEPATH%\gOEYMkgs\lUcU.exe
%HOMEPATH%\gOEYMkgs\ZIwK.exe
%HOMEPATH%\gOEYMkgs\xsUy.exe
%HOMEPATH%\gOEYMkgs\Eocc.exe
%HOMEPATH%\gOEYMkgs\AIMe.exe
%HOMEPATH%\gOEYMkgs\JQIi.exe
%HOMEPATH%\gOEYMkgs\OkIK.exe
%HOMEPATH%\gOEYMkgs\Jkca.exe
%HOMEPATH%\gOEYMkgs\sYAU.exe
%HOMEPATH%\gOEYMkgs\HUUc.exe
%HOMEPATH%\gOEYMkgs\tsAg.exe
%HOMEPATH%\gOEYMkgs\DooM.exe
%HOMEPATH%\gOEYMkgs\vYYm.exe
%HOMEPATH%\gOEYMkgs\AokY.exe
%HOMEPATH%\gOEYMkgs\xsAo.exe
%HOMEPATH%\gOEYMkgs\vUYi.exe
%HOMEPATH%\gOEYMkgs\Tkkk.exe
%HOMEPATH%\gOEYMkgs\KwIi.exe
%HOMEPATH%\gOEYMkgs\UwUu.exe
%HOMEPATH%\gOEYMkgs\TUoG.exe
%HOMEPATH%\gOEYMkgs\Lwsm.exe
%HOMEPATH%\gOEYMkgs\PYEW.exe
%HOMEPATH%\gOEYMkgs\JAEo.exe
%TEMP%\kwQEYMgQ.bat
%HOMEPATH%\gOEYMkgs\kYcq.exe
%HOMEPATH%\gOEYMkgs\ccwE.exe
%HOMEPATH%\gOEYMkgs\xcIk.exe
%HOMEPATH%\gOEYMkgs\rMIA.exe
%HOMEPATH%\gOEYMkgs\LEIY.exe
%HOMEPATH%\gOEYMkgs\ScYi.exe
%HOMEPATH%\gOEYMkgs\SkQI.exe
%HOMEPATH%\gOEYMkgs\UoIS.exe
%HOMEPATH%\gOEYMkgs\voYO.exe
%HOMEPATH%\gOEYMkgs\WYEa.exe
%HOMEPATH%\gOEYMkgs\VosY.exe
%HOMEPATH%\gOEYMkgs\IAEw.exe
%HOMEPATH%\gOEYMkgs\CccY.exe
%HOMEPATH%\gOEYMkgs\fUQo.exe
%HOMEPATH%\gOEYMkgs\lEkK.exe
%HOMEPATH%\gOEYMkgs\VYAs.exe
%HOMEPATH%\gOEYMkgs\BwAi.exe
%HOMEPATH%\gOEYMkgs\qMUW.exe
%HOMEPATH%\gOEYMkgs\QIYU.exe
%HOMEPATH%\gOEYMkgs\RwUy.exe
%HOMEPATH%\gOEYMkgs\nsEe.exe
%HOMEPATH%\gOEYMkgs\YYMC.exe
%HOMEPATH%\gOEYMkgs\UggG.exe
%HOMEPATH%\gOEYMkgs\HsMi.exe
%HOMEPATH%\gOEYMkgs\HkQq.exe
%HOMEPATH%\gOEYMkgs\UsQy.exe
%HOMEPATH%\gOEYMkgs\ZUAa.exe
%HOMEPATH%\gOEYMkgs\BMIi.exe
%HOMEPATH%\gOEYMkgs\NoYY.exe
%HOMEPATH%\gOEYMkgs\qIsA.exe
%HOMEPATH%\gOEYMkgs\skIK.exe
%HOMEPATH%\gOEYMkgs\EcUo.exe
%HOMEPATH%\gOEYMkgs\YcgK.exe
%HOMEPATH%\gOEYMkgs\wcwc.exe
%HOMEPATH%\gOEYMkgs\hAMG.exe
%HOMEPATH%\gOEYMkgs\iIUE.exe
%HOMEPATH%\gOEYMkgs\AsAY.exe
%HOMEPATH%\gOEYMkgs\RYYC.exe
%HOMEPATH%\gOEYMkgs\LwQs.exe
%HOMEPATH%\gOEYMkgs\xwUc.exe
%HOMEPATH%\gOEYMkgs\Wcwu.exe
%HOMEPATH%\gOEYMkgs\OcIU.exe
%HOMEPATH%\gOEYMkgs\pIkS.exe
%HOMEPATH%\gOEYMkgs\Eckc.exe
%HOMEPATH%\gOEYMkgs\nYAo.exe
%HOMEPATH%\gOEYMkgs\IMYI.exe
%HOMEPATH%\gOEYMkgs\woUq.exe
%HOMEPATH%\gOEYMkgs\fcsK.exe
%HOMEPATH%\gOEYMkgs\zEIU.exe
%HOMEPATH%\gOEYMkgs\tsMA.exe
%HOMEPATH%\gOEYMkgs\ZUYA.exe
%HOMEPATH%\gOEYMkgs\tIAe.exe
%HOMEPATH%\gOEYMkgs\zocS.exe
%HOMEPATH%\gOEYMkgs\scsO.exe
%HOMEPATH%\gOEYMkgs\oQQO.exe
%HOMEPATH%\gOEYMkgs\fcYU.exe
%HOMEPATH%\gOEYMkgs\nQMQ.exe
%HOMEPATH%\gOEYMkgs\aYMA.exe
%HOMEPATH%\gOEYMkgs\GMQs.exe
%HOMEPATH%\gOEYMkgs\XgYo.exe
%HOMEPATH%\gOEYMkgs\VoMY.exe
%HOMEPATH%\gOEYMkgs\vMIi.exe
%HOMEPATH%\gOEYMkgs\qkEM.exe
%HOMEPATH%\gOEYMkgs\mIUc.exe
%HOMEPATH%\gOEYMkgs\UkQS.exe
%HOMEPATH%\gOEYMkgs\Usku.exe
%HOMEPATH%\gOEYMkgs\lcwe.exe
%HOMEPATH%\gOEYMkgs\gQsi.exe
%HOMEPATH%\gOEYMkgs\vIcW.exe
%HOMEPATH%\gOEYMkgs\NYUA.exe
%HOMEPATH%\gOEYMkgs\zskQ.exe

Deletes itself.

Network activity:

Connects to:

'74.##5.232.51':443
'ap#.###coincharts.com':443
'74.##5.232.51':80

TCP:

HTTP GET requests:

http:/// via 74.##5.232.51
http://google.com/ via 74.##5.232.51

UDP:

DNS ASK ma##.google.com
DNS ASK ap#.###coincharts.com
DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Run'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: '' WindowName: 'Open'
ClassName: 'WorkerW' WindowName: ''
ClassName: 'DV2ControlHost' WindowName: ''
ClassName: 'BUTTON' WindowName: 'START'
ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'lacMcYws.exe'
ClassName: '' WindowName: 'xSMgIcIg'
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Windows Internet Explorer'
ClassName: '' WindowName: 'Open File'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial