Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
- <STUBS_DIR>\test.exe
- C:\Far2\Far.exe
- hidden files
- file extensions
- User Account Control (UAC)
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- <SYSTEM32>\cmd.exe
- %HOMEPATH%\gOEYMkgs\jYkg.exe
- %HOMEPATH%\gOEYMkgs\IgMw.exe
- %HOMEPATH%\gOEYMkgs\wcYa.exe
- %HOMEPATH%\gOEYMkgs\tcYa.exe
- %HOMEPATH%\gOEYMkgs\FMYM.exe
- %HOMEPATH%\gOEYMkgs\uAwq.exe
- %HOMEPATH%\gOEYMkgs\WcMw.exe
- %HOMEPATH%\gOEYMkgs\JgUq.exe
- %HOMEPATH%\gOEYMkgs\gkQQ.exe
- %HOMEPATH%\gOEYMkgs\UQEK.exe
- %HOMEPATH%\gOEYMkgs\ikkg.exe
- %HOMEPATH%\gOEYMkgs\jgIQ.exe
- %HOMEPATH%\gOEYMkgs\iIoS.exe
- %HOMEPATH%\gOEYMkgs\tIQO.exe
- %HOMEPATH%\gOEYMkgs\EcgU.exe
- %TEMP%\WERec4e.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\Eggs.exe
- %HOMEPATH%\gOEYMkgs\uQcG.exe
- %HOMEPATH%\gOEYMkgs\AYQU.exe
- %TEMP%\WERec4e.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\XcIm.exe
- %TEMP%\WERec4e.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\AsUy.exe
- %HOMEPATH%\gOEYMkgs\KMcQ.exe
- %HOMEPATH%\gOEYMkgs\zQMe.exe
- %TEMP%\WERec4e.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER6f3d.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\rEQU.exe
- %TEMP%\WER6f3d.dir00\ZgMYMIIE.exe.mdmp
- %TEMP%\WER6f3d.dir00\manifest.txt
- %TEMP%\WER6f3d.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\jAEW.exe
- %HOMEPATH%\gOEYMkgs\pwIA.exe
- %HOMEPATH%\gOEYMkgs\GUQo.exe
- %HOMEPATH%\gOEYMkgs\nskC.exe
- %HOMEPATH%\gOEYMkgs\ZQwQ.exe
- %HOMEPATH%\gOEYMkgs\wIkM.exe
- %HOMEPATH%\gOEYMkgs\QgUM.exe
- %HOMEPATH%\gOEYMkgs\xYsM.exe
- %HOMEPATH%\gOEYMkgs\kwkQ.exe
- %HOMEPATH%\gOEYMkgs\FcYC.exe
- %HOMEPATH%\gOEYMkgs\woMG.exe
- %HOMEPATH%\gOEYMkgs\PgAW.exe
- %HOMEPATH%\gOEYMkgs\TcsA.exe
- %HOMEPATH%\gOEYMkgs\DAkq.exe
- %HOMEPATH%\gOEYMkgs\AMEM.exe
- %HOMEPATH%\gOEYMkgs\XoIe.exe
- %HOMEPATH%\gOEYMkgs\qwkO.exe
- %HOMEPATH%\gOEYMkgs\CQkq.exe
- %HOMEPATH%\gOEYMkgs\jMgs.exe
- %HOMEPATH%\gOEYMkgs\PIsA.exe
- %HOMEPATH%\gOEYMkgs\UAwM.exe
- %HOMEPATH%\gOEYMkgs\FUwW.exe
- %HOMEPATH%\gOEYMkgs\YQsg.exe
- %HOMEPATH%\gOEYMkgs\pkIK.exe
- %HOMEPATH%\gOEYMkgs\MIAI.exe
- %HOMEPATH%\gOEYMkgs\HcgU.exe
- %HOMEPATH%\gOEYMkgs\PUAA.exe
- %HOMEPATH%\gOEYMkgs\tMAq.exe
- %HOMEPATH%\gOEYMkgs\gAcg.exe
- %HOMEPATH%\gOEYMkgs\GcAe.exe
- %HOMEPATH%\gOEYMkgs\cwgS.exe
- %HOMEPATH%\gOEYMkgs\nYIO.exe
- %HOMEPATH%\gOEYMkgs\jwco.exe
- %HOMEPATH%\gOEYMkgs\OkwU.exe
- %HOMEPATH%\gOEYMkgs\xQka.exe
- %HOMEPATH%\gOEYMkgs\Pcgu.exe
- %HOMEPATH%\gOEYMkgs\sUEY.exe
- %HOMEPATH%\gOEYMkgs\roMG.exe
- C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
- %HOMEPATH%\gOEYMkgs\Gkok.exe
- %HOMEPATH%\gOEYMkgs\DcYg.exe
- %HOMEPATH%\gOEYMkgs\foEW.exe
- %HOMEPATH%\gOEYMkgs\xgUq.exe
- %HOMEPATH%\gOEYMkgs\FEQU.exe
- %HOMEPATH%\gOEYMkgs\KsMs.exe
- %HOMEPATH%\gOEYMkgs\WQci.exe
- %HOMEPATH%\gOEYMkgs\esoE.exe
- %HOMEPATH%\gOEYMkgs\LcAI.exe
- %HOMEPATH%\gOEYMkgs\tcwk.exe
- %HOMEPATH%\gOEYMkgs\FkAu.exe
- %HOMEPATH%\gOEYMkgs\EEIc.exe
- %HOMEPATH%\gOEYMkgs\ykwW.exe
- %HOMEPATH%\gOEYMkgs\FIkC.exe
- %HOMEPATH%\gOEYMkgs\xIIE.exe
- %HOMEPATH%\gOEYMkgs\FIAO.exe
- %HOMEPATH%\gOEYMkgs\MAEy.exe
- %HOMEPATH%\gOEYMkgs\pAQc.exe
- %HOMEPATH%\gOEYMkgs\PIoE.exe
- %HOMEPATH%\gOEYMkgs\ugQq.exe
- %HOMEPATH%\gOEYMkgs\aIwu.exe
- %HOMEPATH%\gOEYMkgs\sMgW.exe
- %HOMEPATH%\gOEYMkgs\WYsE.exe
- %HOMEPATH%\gOEYMkgs\JMQK.exe
- %HOMEPATH%\gOEYMkgs\bMUm.exe
- %HOMEPATH%\gOEYMkgs\pwsA.exe
- %HOMEPATH%\gOEYMkgs\ygYs.exe
- %HOMEPATH%\gOEYMkgs\yMwC.exe
- %HOMEPATH%\gOEYMkgs\GUoa.exe
- %HOMEPATH%\gOEYMkgs\UIsI.exe
- %HOMEPATH%\gOEYMkgs\BMgW.exe
- %HOMEPATH%\gOEYMkgs\JUgS.exe
- %HOMEPATH%\gOEYMkgs\bAoY.exe
- %HOMEPATH%\gOEYMkgs\rwkc.exe
- %HOMEPATH%\gOEYMkgs\vIoM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %HOMEPATH%\gOEYMkgs\TAYM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %HOMEPATH%\gOEYMkgs\VwkI.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- <Current directory>\<File name>
- %HOMEPATH%\gOEYMkgs\joYE.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %HOMEPATH%\gOEYMkgs\RAkG.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %HOMEPATH%\gOEYMkgs\mMUw.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %HOMEPATH%\gOEYMkgs\OoAo.exe
- %TEMP%\WER807a.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER807a.dir00\appcompat.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %HOMEPATH%\gOEYMkgs\RUsm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %TEMP%\WER807a.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\mMIc.exe
- %HOMEPATH%\gOEYMkgs\Ewco.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %HOMEPATH%\gOEYMkgs\kEMC.exe
- %TEMP%\WER0e93.dir00\manifest.txt
- %TEMP%\WER0e93.dir00\appcompat.txt
- %ALLUSERSPROFILE%\caQc.txt
- %HOMEPATH%\gOEYMkgs\AwUU.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %HOMEPATH%\gOEYMkgs\gsII.exe
- %TEMP%\WER0e93.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %TEMP%\WER0e93.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %HOMEPATH%\gOEYMkgs\RAIW.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %HOMEPATH%\gOEYMkgs\FIUM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %HOMEPATH%\gOEYMkgs\Yswg.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %HOMEPATH%\gOEYMkgs\wIko.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %HOMEPATH%\gOEYMkgs\Bocq.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %HOMEPATH%\gOEYMkgs\xQMI.exe
- %TEMP%\WER807a.dir00\manifest.txt
- %TEMP%\WERf1c1.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\rcsY.exe
- %HOMEPATH%\gOEYMkgs\joAS.exe
- %HOMEPATH%\gOEYMkgs\aUYK.exe
- %TEMP%\WERf1c1.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\uwYe.exe
- %HOMEPATH%\gOEYMkgs\zAcQ.exe
- %HOMEPATH%\gOEYMkgs\DUkK.exe
- %TEMP%\WERf1c1.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\dYkO.exe
- %TEMP%\WERf1c1.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\HQAw.exe
- %HOMEPATH%\gOEYMkgs\XIEs.exe
- %HOMEPATH%\gOEYMkgs\eskk.exe
- %HOMEPATH%\gOEYMkgs\QMEg.exe
- %HOMEPATH%\gOEYMkgs\vMAs.exe
- %HOMEPATH%\gOEYMkgs\UkYa.exe
- %HOMEPATH%\gOEYMkgs\JAgY.exe
- %HOMEPATH%\gOEYMkgs\iQIO.exe
- %HOMEPATH%\gOEYMkgs\TIEo.exe
- %HOMEPATH%\gOEYMkgs\UwYM.exe
- %HOMEPATH%\gOEYMkgs\fwws.exe
- %HOMEPATH%\gOEYMkgs\Tsou.exe
- %HOMEPATH%\gOEYMkgs\tIMo.exe
- %HOMEPATH%\gOEYMkgs\DMYM.exe
- %HOMEPATH%\gOEYMkgs\FoEs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\xYIK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %HOMEPATH%\gOEYMkgs\GAkQ.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %HOMEPATH%\gOEYMkgs\pgQw.exe
- %HOMEPATH%\gOEYMkgs\XEUY.exe
- %HOMEPATH%\gOEYMkgs\poMU.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\bQYs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %HOMEPATH%\gOEYMkgs\oUgW.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\Ngcc.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %HOMEPATH%\gOEYMkgs\cAci.exe
- %HOMEPATH%\gOEYMkgs\fYEQ.exe
- %HOMEPATH%\gOEYMkgs\ZoEQ.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %HOMEPATH%\gOEYMkgs\YkMQ.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %HOMEPATH%\gOEYMkgs\OcYM.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %HOMEPATH%\gOEYMkgs\CcwK.exe
- %HOMEPATH%\gOEYMkgs\pAQc.exe
- %HOMEPATH%\gOEYMkgs\FUwW.exe
- %HOMEPATH%\gOEYMkgs\FIAO.exe
- %HOMEPATH%\gOEYMkgs\MAEy.exe
- %HOMEPATH%\gOEYMkgs\Eggs.exe
- %HOMEPATH%\gOEYMkgs\tIQO.exe
- %HOMEPATH%\gOEYMkgs\EcgU.exe
- %HOMEPATH%\gOEYMkgs\uQcG.exe
- %HOMEPATH%\gOEYMkgs\AYQU.exe
- %HOMEPATH%\gOEYMkgs\LcAI.exe
- %HOMEPATH%\gOEYMkgs\tcwk.exe
- %HOMEPATH%\gOEYMkgs\ykwW.exe
- %HOMEPATH%\gOEYMkgs\FIkC.exe
- %HOMEPATH%\gOEYMkgs\FkAu.exe
- %HOMEPATH%\gOEYMkgs\ugQq.exe
- %HOMEPATH%\gOEYMkgs\aIwu.exe
- %HOMEPATH%\gOEYMkgs\xIIE.exe
- %HOMEPATH%\gOEYMkgs\PIoE.exe
- %HOMEPATH%\gOEYMkgs\KMcQ.exe
- %HOMEPATH%\gOEYMkgs\jgIQ.exe
- %HOMEPATH%\gOEYMkgs\iIoS.exe
- %HOMEPATH%\gOEYMkgs\WcMw.exe
- %HOMEPATH%\gOEYMkgs\ikkg.exe
- %HOMEPATH%\gOEYMkgs\JgUq.exe
- %HOMEPATH%\gOEYMkgs\PgAW.exe
- %HOMEPATH%\gOEYMkgs\TcsA.exe
- %HOMEPATH%\gOEYMkgs\gkQQ.exe
- %HOMEPATH%\gOEYMkgs\UQEK.exe
- %HOMEPATH%\gOEYMkgs\AsUy.exe
- %HOMEPATH%\gOEYMkgs\tcYa.exe
- %HOMEPATH%\gOEYMkgs\zQMe.exe
- %HOMEPATH%\gOEYMkgs\XcIm.exe
- %HOMEPATH%\gOEYMkgs\FMYM.exe
- %HOMEPATH%\gOEYMkgs\IgMw.exe
- %HOMEPATH%\gOEYMkgs\wcYa.exe
- %HOMEPATH%\gOEYMkgs\uAwq.exe
- %HOMEPATH%\gOEYMkgs\jYkg.exe
- %HOMEPATH%\gOEYMkgs\EEIc.exe
- %HOMEPATH%\gOEYMkgs\HcgU.exe
- %HOMEPATH%\gOEYMkgs\PUAA.exe
- %HOMEPATH%\gOEYMkgs\xgUq.exe
- %HOMEPATH%\gOEYMkgs\FEQU.exe
- %HOMEPATH%\gOEYMkgs\tMAq.exe
- %HOMEPATH%\gOEYMkgs\MIAI.exe
- %HOMEPATH%\gOEYMkgs\gAcg.exe
- %HOMEPATH%\gOEYMkgs\YQsg.exe
- %HOMEPATH%\gOEYMkgs\pkIK.exe
- %HOMEPATH%\gOEYMkgs\sUEY.exe
- %HOMEPATH%\gOEYMkgs\roMG.exe
- %HOMEPATH%\gOEYMkgs\Gkok.exe
- %HOMEPATH%\gOEYMkgs\Pcgu.exe
- %HOMEPATH%\gOEYMkgs\DcYg.exe
- %HOMEPATH%\gOEYMkgs\esoE.exe
- %HOMEPATH%\gOEYMkgs\foEW.exe
- %HOMEPATH%\gOEYMkgs\KsMs.exe
- %HOMEPATH%\gOEYMkgs\WQci.exe
- %HOMEPATH%\gOEYMkgs\jwco.exe
- %HOMEPATH%\gOEYMkgs\yMwC.exe
- %HOMEPATH%\gOEYMkgs\JUgS.exe
- %HOMEPATH%\gOEYMkgs\WYsE.exe
- %HOMEPATH%\gOEYMkgs\JMQK.exe
- %HOMEPATH%\gOEYMkgs\bAoY.exe
- %HOMEPATH%\gOEYMkgs\UIsI.exe
- %HOMEPATH%\gOEYMkgs\BMgW.exe
- %HOMEPATH%\gOEYMkgs\rwkc.exe
- %HOMEPATH%\gOEYMkgs\GUoa.exe
- %HOMEPATH%\gOEYMkgs\GcAe.exe
- %HOMEPATH%\gOEYMkgs\cwgS.exe
- %HOMEPATH%\gOEYMkgs\OkwU.exe
- %HOMEPATH%\gOEYMkgs\xQka.exe
- %HOMEPATH%\gOEYMkgs\nYIO.exe
- %HOMEPATH%\gOEYMkgs\ygYs.exe
- %HOMEPATH%\gOEYMkgs\sMgW.exe
- %HOMEPATH%\gOEYMkgs\bMUm.exe
- %HOMEPATH%\gOEYMkgs\pwsA.exe
- %HOMEPATH%\gOEYMkgs\DAkq.exe
- %HOMEPATH%\gOEYMkgs\pgQw.exe
- %HOMEPATH%\gOEYMkgs\xYIK.exe
- %HOMEPATH%\gOEYMkgs\YkMQ.exe
- %HOMEPATH%\gOEYMkgs\GAkQ.exe
- %HOMEPATH%\gOEYMkgs\XEUY.exe
- %HOMEPATH%\gOEYMkgs\bQYs.exe
- %HOMEPATH%\gOEYMkgs\RUsm.exe
- %HOMEPATH%\gOEYMkgs\oUgW.exe
- %HOMEPATH%\gOEYMkgs\poMU.exe
- %HOMEPATH%\gOEYMkgs\dYkO.exe
- %HOMEPATH%\gOEYMkgs\fYEQ.exe
- %HOMEPATH%\gOEYMkgs\XIEs.exe
- %HOMEPATH%\gOEYMkgs\DUkK.exe
- %HOMEPATH%\gOEYMkgs\ZoEQ.exe
- %HOMEPATH%\gOEYMkgs\OcYM.exe
- %HOMEPATH%\gOEYMkgs\CcwK.exe
- %HOMEPATH%\gOEYMkgs\Ngcc.exe
- %HOMEPATH%\gOEYMkgs\cAci.exe
- %HOMEPATH%\gOEYMkgs\OoAo.exe
- %HOMEPATH%\gOEYMkgs\RAIW.exe
- %HOMEPATH%\gOEYMkgs\FIUM.exe
- %HOMEPATH%\gOEYMkgs\RAkG.exe
- %HOMEPATH%\gOEYMkgs\Yswg.exe
- %HOMEPATH%\gOEYMkgs\Bocq.exe
- %HOMEPATH%\gOEYMkgs\AwUU.exe
- %HOMEPATH%\gOEYMkgs\gsII.exe
- %HOMEPATH%\gOEYMkgs\xQMI.exe
- %HOMEPATH%\gOEYMkgs\wIko.exe
- %HOMEPATH%\gOEYMkgs\mMIc.exe
- %HOMEPATH%\gOEYMkgs\VwkI.exe
- %HOMEPATH%\gOEYMkgs\Ewco.exe
- %HOMEPATH%\gOEYMkgs\kEMC.exe
- %HOMEPATH%\gOEYMkgs\vIoM.exe
- %HOMEPATH%\gOEYMkgs\mMUw.exe
- %HOMEPATH%\gOEYMkgs\joYE.exe
- %HOMEPATH%\gOEYMkgs\TAYM.exe
- %TEMP%\MsEYQwoY.bat
- %HOMEPATH%\gOEYMkgs\HQAw.exe
- %HOMEPATH%\gOEYMkgs\rEQU.exe
- %HOMEPATH%\gOEYMkgs\pwIA.exe
- %HOMEPATH%\gOEYMkgs\CQkq.exe
- %HOMEPATH%\gOEYMkgs\jAEW.exe
- %HOMEPATH%\gOEYMkgs\wIkM.exe
- %HOMEPATH%\gOEYMkgs\GUQo.exe
- %HOMEPATH%\gOEYMkgs\nskC.exe
- %HOMEPATH%\gOEYMkgs\QgUM.exe
- %HOMEPATH%\gOEYMkgs\xYsM.exe
- %HOMEPATH%\gOEYMkgs\woMG.exe
- %HOMEPATH%\gOEYMkgs\AMEM.exe
- %HOMEPATH%\gOEYMkgs\kwkQ.exe
- %HOMEPATH%\gOEYMkgs\FcYC.exe
- %HOMEPATH%\gOEYMkgs\jMgs.exe
- %HOMEPATH%\gOEYMkgs\XoIe.exe
- %HOMEPATH%\gOEYMkgs\qwkO.exe
- %HOMEPATH%\gOEYMkgs\PIsA.exe
- %HOMEPATH%\gOEYMkgs\UAwM.exe
- %HOMEPATH%\gOEYMkgs\ZQwQ.exe
- %HOMEPATH%\gOEYMkgs\fwws.exe
- %HOMEPATH%\gOEYMkgs\Tsou.exe
- %HOMEPATH%\gOEYMkgs\FoEs.exe
- %HOMEPATH%\gOEYMkgs\UwYM.exe
- %HOMEPATH%\gOEYMkgs\aUYK.exe
- %HOMEPATH%\gOEYMkgs\joAS.exe
- %HOMEPATH%\gOEYMkgs\zAcQ.exe
- %HOMEPATH%\gOEYMkgs\uwYe.exe
- %HOMEPATH%\gOEYMkgs\rcsY.exe
- %HOMEPATH%\gOEYMkgs\iQIO.exe
- %HOMEPATH%\gOEYMkgs\eskk.exe
- %HOMEPATH%\gOEYMkgs\UkYa.exe
- %HOMEPATH%\gOEYMkgs\JAgY.exe
- %HOMEPATH%\gOEYMkgs\QMEg.exe
- %HOMEPATH%\gOEYMkgs\tIMo.exe
- %HOMEPATH%\gOEYMkgs\DMYM.exe
- %HOMEPATH%\gOEYMkgs\vMAs.exe
- %HOMEPATH%\gOEYMkgs\TIEo.exe
- '74.##5.232.51':443
- 'ap#.###coincharts.com':443
- '74.##5.232.51':80
- http://google.com/ via 74.##5.232.51
- http:/// via 74.##5.232.51
- DNS ASK ma##.google.com
- DNS ASK ap#.###coincharts.com
- DNS ASK google.com
- ClassName: '' WindowName: 'Run'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: '' WindowName: 'Open'
- ClassName: 'WorkerW' WindowName: ''
- ClassName: 'DV2ControlHost' WindowName: ''
- ClassName: 'BUTTON' WindowName: 'START'
- ClassName: '' WindowName: 'lacMcYws.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
- ClassName: '' WindowName: 'xSMgIcIg'
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: 'Windows Internet Explorer'
- ClassName: '' WindowName: 'Open File'