Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
- <STUBS_DIR>\test.exe
- C:\Far2\Far.exe
- hidden files
- file extensions
- User Account Control (UAC)
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- <SYSTEM32>\cmd.exe
- %TEMP%\WER8c68.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\GosW.exe
- %TEMP%\WER8c68.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\lkMw.exe
- %HOMEPATH%\gOEYMkgs\YAIe.exe
- %HOMEPATH%\gOEYMkgs\IgkI.exe
- %HOMEPATH%\gOEYMkgs\qMQC.exe
- %HOMEPATH%\gOEYMkgs\AIoQ.exe
- %HOMEPATH%\gOEYMkgs\pMMU.exe
- %HOMEPATH%\gOEYMkgs\OYwa.exe
- %HOMEPATH%\gOEYMkgs\vYwq.exe
- %TEMP%\WER8c68.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\MAQY.exe
- %HOMEPATH%\gOEYMkgs\AIUW.exe
- %HOMEPATH%\gOEYMkgs\vIoQ.exe
- %HOMEPATH%\gOEYMkgs\uIYK.exe
- %HOMEPATH%\gOEYMkgs\koMq.exe
- %HOMEPATH%\gOEYMkgs\FIsu.exe
- %HOMEPATH%\gOEYMkgs\Tkwo.exe
- %HOMEPATH%\gOEYMkgs\ugQs.exe
- %HOMEPATH%\gOEYMkgs\TAIM.exe
- %HOMEPATH%\gOEYMkgs\FMUk.exe
- %HOMEPATH%\gOEYMkgs\ywgq.exe
- %HOMEPATH%\gOEYMkgs\FkEk.exe
- %HOMEPATH%\gOEYMkgs\PEcs.exe
- %TEMP%\WER8c68.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\HoAG.exe
- %HOMEPATH%\gOEYMkgs\vssw.exe
- %HOMEPATH%\gOEYMkgs\xkcA.exe
- %HOMEPATH%\gOEYMkgs\cIka.exe
- %HOMEPATH%\gOEYMkgs\Qcsm.exe
- %HOMEPATH%\gOEYMkgs\pscU.exe
- %HOMEPATH%\gOEYMkgs\DwgW.exe
- %HOMEPATH%\gOEYMkgs\SgwI.exe
- %HOMEPATH%\gOEYMkgs\ycwa.exe
- %HOMEPATH%\gOEYMkgs\nUMM.exe
- %HOMEPATH%\gOEYMkgs\RkwI.exe
- %HOMEPATH%\gOEYMkgs\GAcG.exe
- %HOMEPATH%\gOEYMkgs\EUYw.exe
- %HOMEPATH%\gOEYMkgs\qUUe.exe
- %HOMEPATH%\gOEYMkgs\XoQG.exe
- %HOMEPATH%\gOEYMkgs\YQAe.exe
- %HOMEPATH%\gOEYMkgs\jQAa.exe
- %HOMEPATH%\gOEYMkgs\lIoQ.exe
- %HOMEPATH%\gOEYMkgs\NAoU.exe
- %HOMEPATH%\gOEYMkgs\zEcQ.exe
- %HOMEPATH%\gOEYMkgs\CMYy.exe
- %HOMEPATH%\gOEYMkgs\YgwQ.exe
- %HOMEPATH%\gOEYMkgs\ncsw.exe
- %HOMEPATH%\gOEYMkgs\EEgi.exe
- %HOMEPATH%\gOEYMkgs\bYYM.exe
- %HOMEPATH%\gOEYMkgs\sMka.exe
- %HOMEPATH%\gOEYMkgs\FkwG.exe
- %HOMEPATH%\gOEYMkgs\bYQQ.exe
- %HOMEPATH%\gOEYMkgs\qgYm.exe
- %HOMEPATH%\gOEYMkgs\SIwk.exe
- %HOMEPATH%\gOEYMkgs\NcQk.exe
- %HOMEPATH%\gOEYMkgs\bwUM.exe
- %HOMEPATH%\gOEYMkgs\vQAg.exe
- %HOMEPATH%\gOEYMkgs\JAca.exe
- %HOMEPATH%\gOEYMkgs\PssW.exe
- %HOMEPATH%\gOEYMkgs\OgEG.exe
- %HOMEPATH%\gOEYMkgs\zogO.exe
- %HOMEPATH%\gOEYMkgs\loAE.exe
- %HOMEPATH%\gOEYMkgs\TEoS.exe
- %TEMP%\WER064a.dir00\appcompat.txt
- %TEMP%\WER064a.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER064a.dir00\ZgMYMIIE.exe.mdmp
- C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
- %TEMP%\WER064a.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\XUAo.exe
- %HOMEPATH%\gOEYMkgs\fcIC.exe
- %HOMEPATH%\gOEYMkgs\RgAW.exe
- %HOMEPATH%\gOEYMkgs\gIYE.exe
- %HOMEPATH%\gOEYMkgs\hQwu.exe
- %HOMEPATH%\gOEYMkgs\PMYs.exe
- %HOMEPATH%\gOEYMkgs\WQcy.exe
- %HOMEPATH%\gOEYMkgs\YYoI.exe
- %HOMEPATH%\gOEYMkgs\ZowY.exe
- %HOMEPATH%\gOEYMkgs\KMcq.exe
- %HOMEPATH%\gOEYMkgs\OkAi.exe
- %HOMEPATH%\gOEYMkgs\tgwK.exe
- %HOMEPATH%\gOEYMkgs\OEwc.exe
- %HOMEPATH%\gOEYMkgs\BQci.exe
- %HOMEPATH%\gOEYMkgs\GsgI.exe
- %HOMEPATH%\gOEYMkgs\JIsK.exe
- %HOMEPATH%\gOEYMkgs\xowY.exe
- %HOMEPATH%\gOEYMkgs\DcIe.exe
- %HOMEPATH%\gOEYMkgs\kIIc.exe
- %HOMEPATH%\gOEYMkgs\uIYO.exe
- %HOMEPATH%\gOEYMkgs\pEIA.exe
- %HOMEPATH%\gOEYMkgs\vQcG.exe
- %HOMEPATH%\gOEYMkgs\EYwc.exe
- %HOMEPATH%\gOEYMkgs\YwQE.exe
- %HOMEPATH%\gOEYMkgs\EAYO.exe
- %HOMEPATH%\gOEYMkgs\dAEk.exe
- %HOMEPATH%\gOEYMkgs\ZYUA.exe
- %HOMEPATH%\gOEYMkgs\TUIq.exe
- %HOMEPATH%\gOEYMkgs\XUII.exe
- %HOMEPATH%\gOEYMkgs\NkAG.exe
- %HOMEPATH%\gOEYMkgs\MwQe.exe
- %HOMEPATH%\gOEYMkgs\JEgG.exe
- %HOMEPATH%\gOEYMkgs\EUUs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %HOMEPATH%\gOEYMkgs\oUYg.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %HOMEPATH%\gOEYMkgs\vUcG.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %HOMEPATH%\gOEYMkgs\NccA.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %HOMEPATH%\gOEYMkgs\MgUK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %HOMEPATH%\gOEYMkgs\TYYY.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %HOMEPATH%\gOEYMkgs\GEUM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %HOMEPATH%\gOEYMkgs\Kwka.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %HOMEPATH%\gOEYMkgs\LUUw.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\KkgU.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %HOMEPATH%\gOEYMkgs\iIAc.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %HOMEPATH%\gOEYMkgs\GIIG.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %HOMEPATH%\gOEYMkgs\AQwc.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %TEMP%\WER990a.dir00\appcompat.txt
- %TEMP%\WER990a.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER990a.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %HOMEPATH%\gOEYMkgs\hAko.exe
- %TEMP%\WER990a.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %ALLUSERSPROFILE%\caQc.txt
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %HOMEPATH%\gOEYMkgs\TgYq.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %HOMEPATH%\gOEYMkgs\LYMO.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %HOMEPATH%\gOEYMkgs\fQMu.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %HOMEPATH%\gOEYMkgs\GIsI.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %HOMEPATH%\gOEYMkgs\Iggu.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %HOMEPATH%\gOEYMkgs\sYUI.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %HOMEPATH%\gOEYMkgs\SUsW.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\zQoG.exe
- %HOMEPATH%\gOEYMkgs\XoEi.exe
- %HOMEPATH%\gOEYMkgs\MYAK.exe
- %HOMEPATH%\gOEYMkgs\lksw.exe
- %HOMEPATH%\gOEYMkgs\akUM.exe
- %HOMEPATH%\gOEYMkgs\nIsy.exe
- %HOMEPATH%\gOEYMkgs\HMse.exe
- %HOMEPATH%\gOEYMkgs\wAQM.exe
- %HOMEPATH%\gOEYMkgs\SQoi.exe
- %HOMEPATH%\gOEYMkgs\ZQEE.exe
- %HOMEPATH%\gOEYMkgs\hYAy.exe
- %HOMEPATH%\gOEYMkgs\mgEG.exe
- %HOMEPATH%\gOEYMkgs\iwgo.exe
- %HOMEPATH%\gOEYMkgs\FAEY.exe
- %HOMEPATH%\gOEYMkgs\YsMc.exe
- %HOMEPATH%\gOEYMkgs\wYgc.exe
- %HOMEPATH%\gOEYMkgs\gssw.exe
- %HOMEPATH%\gOEYMkgs\nQAO.exe
- %HOMEPATH%\gOEYMkgs\QIQi.exe
- %HOMEPATH%\gOEYMkgs\dccy.exe
- %HOMEPATH%\gOEYMkgs\mgUy.exe
- %HOMEPATH%\gOEYMkgs\zwwK.exe
- %HOMEPATH%\gOEYMkgs\xsQg.exe
- %HOMEPATH%\gOEYMkgs\fcos.exe
- %HOMEPATH%\gOEYMkgs\MQEu.exe
- %HOMEPATH%\gOEYMkgs\uAQw.exe
- %HOMEPATH%\gOEYMkgs\DUog.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %HOMEPATH%\gOEYMkgs\HcAI.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %HOMEPATH%\gOEYMkgs\UsYI.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %HOMEPATH%\gOEYMkgs\cYIc.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %HOMEPATH%\gOEYMkgs\NokM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\OssS.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %HOMEPATH%\gOEYMkgs\lEIE.exe
- %TEMP%\WER10ac.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %HOMEPATH%\gOEYMkgs\EMoc.exe
- %TEMP%\WER10ac.dir00\manifest.txt
- %TEMP%\WER10ac.dir00\appcompat.txt
- %TEMP%\WER10ac.dir00\ZgMYMIIE.exe.hdmp
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %HOMEPATH%\gOEYMkgs\bMIG.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %HOMEPATH%\gOEYMkgs\tEwS.exe
- <Current directory>\<File name>
- %HOMEPATH%\gOEYMkgs\JIsK.exe
- %HOMEPATH%\gOEYMkgs\sMka.exe
- %HOMEPATH%\gOEYMkgs\BQci.exe
- %HOMEPATH%\gOEYMkgs\GsgI.exe
- %HOMEPATH%\gOEYMkgs\koMq.exe
- %HOMEPATH%\gOEYMkgs\AIUW.exe
- %HOMEPATH%\gOEYMkgs\vIoQ.exe
- %HOMEPATH%\gOEYMkgs\FIsu.exe
- %HOMEPATH%\gOEYMkgs\Tkwo.exe
- %HOMEPATH%\gOEYMkgs\kIIc.exe
- %HOMEPATH%\gOEYMkgs\tgwK.exe
- %HOMEPATH%\gOEYMkgs\OEwc.exe
- %HOMEPATH%\gOEYMkgs\uIYO.exe
- %HOMEPATH%\gOEYMkgs\OkAi.exe
- %HOMEPATH%\gOEYMkgs\YYoI.exe
- %HOMEPATH%\gOEYMkgs\xowY.exe
- %HOMEPATH%\gOEYMkgs\DcIe.exe
- %HOMEPATH%\gOEYMkgs\ZowY.exe
- %HOMEPATH%\gOEYMkgs\KMcq.exe
- %HOMEPATH%\gOEYMkgs\uIYK.exe
- %HOMEPATH%\gOEYMkgs\vYwq.exe
- %HOMEPATH%\gOEYMkgs\qMQC.exe
- %HOMEPATH%\gOEYMkgs\GosW.exe
- %HOMEPATH%\gOEYMkgs\OYwa.exe
- %HOMEPATH%\gOEYMkgs\AIoQ.exe
- %HOMEPATH%\gOEYMkgs\lIoQ.exe
- %HOMEPATH%\gOEYMkgs\NAoU.exe
- %HOMEPATH%\gOEYMkgs\pMMU.exe
- %HOMEPATH%\gOEYMkgs\jQAa.exe
- %HOMEPATH%\gOEYMkgs\IgkI.exe
- %HOMEPATH%\gOEYMkgs\PEcs.exe
- %HOMEPATH%\gOEYMkgs\ugQs.exe
- %HOMEPATH%\gOEYMkgs\ywgq.exe
- %HOMEPATH%\gOEYMkgs\FkEk.exe
- %HOMEPATH%\gOEYMkgs\TAIM.exe
- %HOMEPATH%\gOEYMkgs\lkMw.exe
- %HOMEPATH%\gOEYMkgs\YAIe.exe
- %HOMEPATH%\gOEYMkgs\FMUk.exe
- %HOMEPATH%\gOEYMkgs\MAQY.exe
- %HOMEPATH%\gOEYMkgs\XUII.exe
- %HOMEPATH%\gOEYMkgs\fcIC.exe
- %HOMEPATH%\gOEYMkgs\RgAW.exe
- %HOMEPATH%\gOEYMkgs\PMYs.exe
- %HOMEPATH%\gOEYMkgs\XUAo.exe
- %HOMEPATH%\gOEYMkgs\TEoS.exe
- %HOMEPATH%\gOEYMkgs\bwUM.exe
- %HOMEPATH%\gOEYMkgs\FkwG.exe
- %HOMEPATH%\gOEYMkgs\SIwk.exe
- %HOMEPATH%\gOEYMkgs\NcQk.exe
- %HOMEPATH%\gOEYMkgs\hQwu.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\RestorePointSize
- %HOMEPATH%\gOEYMkgs\gIYE.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP13\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\rp.log
- %HOMEPATH%\gOEYMkgs\bYQQ.exe
- %HOMEPATH%\gOEYMkgs\vQcG.exe
- %HOMEPATH%\gOEYMkgs\EYwc.exe
- %HOMEPATH%\gOEYMkgs\dAEk.exe
- %HOMEPATH%\gOEYMkgs\pEIA.exe
- %HOMEPATH%\gOEYMkgs\NkAG.exe
- %HOMEPATH%\gOEYMkgs\ZYUA.exe
- %HOMEPATH%\gOEYMkgs\TUIq.exe
- %HOMEPATH%\gOEYMkgs\MwQe.exe
- %HOMEPATH%\gOEYMkgs\JEgG.exe
- %HOMEPATH%\gOEYMkgs\EAYO.exe
- %HOMEPATH%\gOEYMkgs\zogO.exe
- %HOMEPATH%\gOEYMkgs\loAE.exe
- %HOMEPATH%\gOEYMkgs\qgYm.exe
- %HOMEPATH%\gOEYMkgs\OgEG.exe
- %HOMEPATH%\gOEYMkgs\vQAg.exe
- %HOMEPATH%\gOEYMkgs\WQcy.exe
- %HOMEPATH%\gOEYMkgs\YwQE.exe
- %HOMEPATH%\gOEYMkgs\JAca.exe
- %HOMEPATH%\gOEYMkgs\PssW.exe
- %HOMEPATH%\gOEYMkgs\qUUe.exe
- %HOMEPATH%\gOEYMkgs\UsYI.exe
- %HOMEPATH%\gOEYMkgs\DUog.exe
- %HOMEPATH%\gOEYMkgs\bMIG.exe
- %HOMEPATH%\gOEYMkgs\lEIE.exe
- %HOMEPATH%\gOEYMkgs\HcAI.exe
- %HOMEPATH%\gOEYMkgs\NokM.exe
- %HOMEPATH%\gOEYMkgs\LUUw.exe
- %HOMEPATH%\gOEYMkgs\OssS.exe
- %HOMEPATH%\gOEYMkgs\cYIc.exe
- %TEMP%\ywcEAAEI.bat
- %HOMEPATH%\gOEYMkgs\mgEG.exe
- %HOMEPATH%\gOEYMkgs\HMse.exe
- %HOMEPATH%\gOEYMkgs\ZQEE.exe
- %HOMEPATH%\gOEYMkgs\hYAy.exe
- %HOMEPATH%\gOEYMkgs\wAQM.exe
- %HOMEPATH%\gOEYMkgs\EMoc.exe
- %HOMEPATH%\gOEYMkgs\tEwS.exe
- %HOMEPATH%\gOEYMkgs\SQoi.exe
- %HOMEPATH%\gOEYMkgs\uAQw.exe
- %HOMEPATH%\gOEYMkgs\KkgU.exe
- %HOMEPATH%\gOEYMkgs\GIsI.exe
- %HOMEPATH%\gOEYMkgs\LYMO.exe
- %HOMEPATH%\gOEYMkgs\MgUK.exe
- %HOMEPATH%\gOEYMkgs\fQMu.exe
- %HOMEPATH%\gOEYMkgs\sYUI.exe
- %HOMEPATH%\gOEYMkgs\TgYq.exe
- %HOMEPATH%\gOEYMkgs\hAko.exe
- %HOMEPATH%\gOEYMkgs\SUsW.exe
- %HOMEPATH%\gOEYMkgs\Iggu.exe
- %HOMEPATH%\gOEYMkgs\NccA.exe
- %HOMEPATH%\gOEYMkgs\AQwc.exe
- %HOMEPATH%\gOEYMkgs\iIAc.exe
- %HOMEPATH%\gOEYMkgs\Kwka.exe
- %HOMEPATH%\gOEYMkgs\GIIG.exe
- %HOMEPATH%\gOEYMkgs\GEUM.exe
- %HOMEPATH%\gOEYMkgs\oUYg.exe
- %HOMEPATH%\gOEYMkgs\TYYY.exe
- %HOMEPATH%\gOEYMkgs\vUcG.exe
- %HOMEPATH%\gOEYMkgs\EUUs.exe
- %HOMEPATH%\gOEYMkgs\MYAK.exe
- %HOMEPATH%\gOEYMkgs\HoAG.exe
- %HOMEPATH%\gOEYMkgs\vssw.exe
- %HOMEPATH%\gOEYMkgs\Qcsm.exe
- %HOMEPATH%\gOEYMkgs\pscU.exe
- %HOMEPATH%\gOEYMkgs\xkcA.exe
- %HOMEPATH%\gOEYMkgs\GAcG.exe
- %HOMEPATH%\gOEYMkgs\DwgW.exe
- %HOMEPATH%\gOEYMkgs\nUMM.exe
- %HOMEPATH%\gOEYMkgs\RkwI.exe
- %HOMEPATH%\gOEYMkgs\cIka.exe
- %HOMEPATH%\gOEYMkgs\ncsw.exe
- %HOMEPATH%\gOEYMkgs\EEgi.exe
- %HOMEPATH%\gOEYMkgs\XoQG.exe
- %HOMEPATH%\gOEYMkgs\YQAe.exe
- %HOMEPATH%\gOEYMkgs\bYYM.exe
- %HOMEPATH%\gOEYMkgs\YgwQ.exe
- %HOMEPATH%\gOEYMkgs\EUYw.exe
- %HOMEPATH%\gOEYMkgs\zEcQ.exe
- %HOMEPATH%\gOEYMkgs\CMYy.exe
- %HOMEPATH%\gOEYMkgs\SgwI.exe
- %HOMEPATH%\gOEYMkgs\zwwK.exe
- %HOMEPATH%\gOEYMkgs\iwgo.exe
- %HOMEPATH%\gOEYMkgs\dccy.exe
- %HOMEPATH%\gOEYMkgs\mgUy.exe
- %HOMEPATH%\gOEYMkgs\lksw.exe
- %HOMEPATH%\gOEYMkgs\zQoG.exe
- %HOMEPATH%\gOEYMkgs\XoEi.exe
- %HOMEPATH%\gOEYMkgs\akUM.exe
- %HOMEPATH%\gOEYMkgs\nIsy.exe
- %HOMEPATH%\gOEYMkgs\MQEu.exe
- %HOMEPATH%\gOEYMkgs\nQAO.exe
- %HOMEPATH%\gOEYMkgs\QIQi.exe
- %HOMEPATH%\gOEYMkgs\ycwa.exe
- %HOMEPATH%\gOEYMkgs\gssw.exe
- %HOMEPATH%\gOEYMkgs\FAEY.exe
- %HOMEPATH%\gOEYMkgs\xsQg.exe
- %HOMEPATH%\gOEYMkgs\fcos.exe
- %HOMEPATH%\gOEYMkgs\YsMc.exe
- %HOMEPATH%\gOEYMkgs\wYgc.exe
- '74.##5.232.51':443
- 'ap#.###coincharts.com':443
- '74.##5.232.51':80
- http://google.com/ via 74.##5.232.51
- http:/// via 74.##5.232.51
- DNS ASK ma##.google.com
- DNS ASK ap#.###coincharts.com
- DNS ASK google.com
- ClassName: '' WindowName: 'Run'
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: 'Open'
- ClassName: 'WorkerW' WindowName: ''
- ClassName: 'DV2ControlHost' WindowName: ''
- ClassName: 'BUTTON' WindowName: 'START'
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'lacMcYws.exe'
- ClassName: '' WindowName: 'xSMgIcIg'
- ClassName: '' WindowName: 'Windows Internet Explorer'
- ClassName: '' WindowName: 'Open File'
- ClassName: 'Shell_TrayWnd' WindowName: ''