Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
- <STUBS_DIR>\test.exe
- C:\Far2\Far.exe
- hidden files
- file extensions
- User Account Control (UAC)
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- %HOMEPATH%\gOEYMkgs\skgW.exe
- %HOMEPATH%\gOEYMkgs\jQAg.exe
- %HOMEPATH%\gOEYMkgs\ioge.exe
- %HOMEPATH%\gOEYMkgs\hYsM.exe
- %HOMEPATH%\gOEYMkgs\aAcU.exe
- %HOMEPATH%\gOEYMkgs\FsAu.exe
- %HOMEPATH%\gOEYMkgs\LQsW.exe
- %HOMEPATH%\gOEYMkgs\cwsW.exe
- %HOMEPATH%\gOEYMkgs\CYgW.exe
- %HOMEPATH%\gOEYMkgs\UEcy.exe
- %HOMEPATH%\gOEYMkgs\zowi.exe
- %HOMEPATH%\gOEYMkgs\RQsA.exe
- %HOMEPATH%\gOEYMkgs\fMga.exe
- %HOMEPATH%\gOEYMkgs\uYYs.exe
- %HOMEPATH%\gOEYMkgs\XgUc.exe
- %HOMEPATH%\gOEYMkgs\LgcM.exe
- %HOMEPATH%\gOEYMkgs\ssUA.exe
- %HOMEPATH%\gOEYMkgs\LcYI.exe
- %HOMEPATH%\gOEYMkgs\xEsK.exe
- %HOMEPATH%\gOEYMkgs\rwEm.exe
- %HOMEPATH%\gOEYMkgs\AIAe.exe
- %HOMEPATH%\gOEYMkgs\JksS.exe
- %HOMEPATH%\gOEYMkgs\McMS.exe
- %HOMEPATH%\gOEYMkgs\VEQO.exe
- %HOMEPATH%\gOEYMkgs\UAsU.exe
- %HOMEPATH%\gOEYMkgs\VMQG.exe
- %HOMEPATH%\gOEYMkgs\RcMk.exe
- %HOMEPATH%\gOEYMkgs\bMQu.exe
- %HOMEPATH%\gOEYMkgs\DcwG.exe
- %HOMEPATH%\gOEYMkgs\CEEI.exe
- %HOMEPATH%\gOEYMkgs\vcYs.exe
- %HOMEPATH%\gOEYMkgs\DoAy.exe
- %HOMEPATH%\gOEYMkgs\tIsI.exe
- %HOMEPATH%\gOEYMkgs\rEgu.exe
- %HOMEPATH%\gOEYMkgs\NIwk.exe
- %HOMEPATH%\gOEYMkgs\wQoY.exe
- %HOMEPATH%\gOEYMkgs\MssS.exe
- %HOMEPATH%\gOEYMkgs\KkYU.exe
- %HOMEPATH%\gOEYMkgs\psoa.exe
- %HOMEPATH%\gOEYMkgs\QQIc.exe
- %HOMEPATH%\gOEYMkgs\GUEw.exe
- %TEMP%\WER4884.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\FgQo.exe
- %HOMEPATH%\gOEYMkgs\Jcwu.exe
- %HOMEPATH%\gOEYMkgs\nQoq.exe
- %HOMEPATH%\gOEYMkgs\dIgI.exe
- %HOMEPATH%\gOEYMkgs\XswI.exe
- %HOMEPATH%\gOEYMkgs\YQsC.exe
- %HOMEPATH%\gOEYMkgs\qYUk.exe
- %HOMEPATH%\gOEYMkgs\lsUg.exe
- %TEMP%\WER4884.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\mUUM.exe
- %TEMP%\WER4884.dir00\manifest.txt
- %TEMP%\WER4884.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\bQwW.exe
- %HOMEPATH%\gOEYMkgs\Dcoq.exe
- %HOMEPATH%\gOEYMkgs\AkUc.exe
- %HOMEPATH%\gOEYMkgs\Ckgg.exe
- %HOMEPATH%\gOEYMkgs\sQMs.exe
- %HOMEPATH%\gOEYMkgs\OsQK.exe
- %HOMEPATH%\gOEYMkgs\moMy.exe
- %HOMEPATH%\gOEYMkgs\tgcs.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
- %HOMEPATH%\gOEYMkgs\PQQk.exe
- %HOMEPATH%\gOEYMkgs\sgcQ.exe
- %HOMEPATH%\gOEYMkgs\uIMs.exe
- %HOMEPATH%\gOEYMkgs\aYgq.exe
- %HOMEPATH%\gOEYMkgs\pYcK.exe
- %TEMP%\WER3e8d.dir00\ZgMYMIIE.exe.mdmp
- %TEMP%\WERa940.dir00\ZgMYMIIE.exe.mdmp
- %TEMP%\WER3e8d.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\CYYs.exe
- %TEMP%\WERa940.dir00\manifest.txt
- %TEMP%\WERa940.dir00\appcompat.txt
- %TEMP%\WERa940.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER3e8d.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\fAIU.exe
- %HOMEPATH%\gOEYMkgs\YsYq.exe
- %HOMEPATH%\gOEYMkgs\FsgW.exe
- %HOMEPATH%\gOEYMkgs\YEoq.exe
- %TEMP%\WER3e8d.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\cIIm.exe
- %HOMEPATH%\gOEYMkgs\qUMm.exe
- %TEMP%\WERc674.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\PgUk.exe
- %HOMEPATH%\gOEYMkgs\EAMk.exe
- %HOMEPATH%\gOEYMkgs\cQMg.exe
- %HOMEPATH%\gOEYMkgs\dIkg.exe
- %HOMEPATH%\gOEYMkgs\fYUs.exe
- %HOMEPATH%\gOEYMkgs\AgkA.exe
- %HOMEPATH%\gOEYMkgs\BgUm.exe
- %HOMEPATH%\gOEYMkgs\mogO.exe
- %HOMEPATH%\gOEYMkgs\poog.exe
- %HOMEPATH%\gOEYMkgs\Ykoo.exe
- %HOMEPATH%\gOEYMkgs\ekcI.exe
- %HOMEPATH%\gOEYMkgs\HYwM.exe
- %HOMEPATH%\gOEYMkgs\OIQC.exe
- %HOMEPATH%\gOEYMkgs\xEMe.exe
- %HOMEPATH%\gOEYMkgs\NgwQ.exe
- %HOMEPATH%\gOEYMkgs\RgAY.exe
- %HOMEPATH%\gOEYMkgs\zcgI.exe
- %HOMEPATH%\gOEYMkgs\ZsQQ.exe
- %HOMEPATH%\gOEYMkgs\bMAi.exe
- %HOMEPATH%\gOEYMkgs\TAQG.exe
- %TEMP%\WERc674.dir00\appcompat.txt
- %TEMP%\WERc674.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\qAIY.exe
- %HOMEPATH%\gOEYMkgs\dsca.exe
- %TEMP%\WERc674.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\hMgM.exe
- %HOMEPATH%\gOEYMkgs\ZwcU.exe
- %HOMEPATH%\gOEYMkgs\Sssa.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %HOMEPATH%\gOEYMkgs\uAIy.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %HOMEPATH%\gOEYMkgs\JMEa.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %HOMEPATH%\gOEYMkgs\qsUI.exe
- %TEMP%\WEReb58.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\LokA.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %HOMEPATH%\gOEYMkgs\Aswk.exe
- %HOMEPATH%\gOEYMkgs\fsUY.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %HOMEPATH%\gOEYMkgs\vAQG.exe
- %TEMP%\WER672f.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\GcQu.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %HOMEPATH%\gOEYMkgs\LgkW.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %HOMEPATH%\gOEYMkgs\wwYU.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %HOMEPATH%\gOEYMkgs\yocU.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %HOMEPATH%\gOEYMkgs\JgEA.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %ALLUSERSPROFILE%\caQc.txt
- %TEMP%\WER7146.dir00\manifest.txt
- %TEMP%\WER7146.dir00\appcompat.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %HOMEPATH%\gOEYMkgs\woAy.exe
- <Current directory>\<File name>
- %TEMP%\WER7146.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %TEMP%\WER7146.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %HOMEPATH%\gOEYMkgs\nQkc.exe
- %HOMEPATH%\gOEYMkgs\kMsg.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %HOMEPATH%\gOEYMkgs\lsUc.exe
- %TEMP%\WEReb58.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\iYQo.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %TEMP%\WEReb58.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\zkMi.exe
- %TEMP%\WEReb58.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %HOMEPATH%\gOEYMkgs\tcAK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %TEMP%\WERdda7.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\LgIY.exe
- %HOMEPATH%\gOEYMkgs\zwgG.exe
- %TEMP%\WERdda7.dir00\manifest.txt
- %TEMP%\WERdda7.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\AYAS.exe
- %TEMP%\WERdda7.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\RYgq.exe
- %HOMEPATH%\gOEYMkgs\xYEc.exe
- %HOMEPATH%\gOEYMkgs\PsMQ.exe
- %HOMEPATH%\gOEYMkgs\UkcE.exe
- %HOMEPATH%\gOEYMkgs\oUAM.exe
- %HOMEPATH%\gOEYMkgs\tQow.exe
- %HOMEPATH%\gOEYMkgs\lMEw.exe
- %HOMEPATH%\gOEYMkgs\eAIu.exe
- %HOMEPATH%\gOEYMkgs\VkoO.exe
- %HOMEPATH%\gOEYMkgs\egUm.exe
- %HOMEPATH%\gOEYMkgs\rYwC.exe
- %HOMEPATH%\gOEYMkgs\Fscq.exe
- %HOMEPATH%\gOEYMkgs\ccEo.exe
- %HOMEPATH%\gOEYMkgs\loMy.exe
- %HOMEPATH%\gOEYMkgs\oQAA.exe
- %HOMEPATH%\gOEYMkgs\TkAG.exe
- %HOMEPATH%\gOEYMkgs\sAky.exe
- %HOMEPATH%\gOEYMkgs\RwIu.exe
- %HOMEPATH%\gOEYMkgs\HQAG.exe
- %HOMEPATH%\gOEYMkgs\TMMa.exe
- %HOMEPATH%\gOEYMkgs\SYco.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %HOMEPATH%\gOEYMkgs\xUMM.exe
- %TEMP%\WER672f.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\xwMU.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\KsQu.exe
- %TEMP%\WER672f.dir00\appcompat.txt
- %TEMP%\WER672f.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\EUIo.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %HOMEPATH%\gOEYMkgs\dkYU.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %HOMEPATH%\gOEYMkgs\sYoS.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %HOMEPATH%\gOEYMkgs\ewEs.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %HOMEPATH%\gOEYMkgs\PEgq.exe
- %HOMEPATH%\gOEYMkgs\sEMQ.exe
- %HOMEPATH%\gOEYMkgs\FIIY.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %HOMEPATH%\gOEYMkgs\EAsy.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %HOMEPATH%\gOEYMkgs\jAUo.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %HOMEPATH%\gOEYMkgs\UAsU.exe
- %HOMEPATH%\gOEYMkgs\VMQG.exe
- %HOMEPATH%\gOEYMkgs\ssUA.exe
- %HOMEPATH%\gOEYMkgs\AIAe.exe
- %HOMEPATH%\gOEYMkgs\RcMk.exe
- %HOMEPATH%\gOEYMkgs\VEQO.exe
- %HOMEPATH%\gOEYMkgs\uYYs.exe
- %HOMEPATH%\gOEYMkgs\JksS.exe
- %HOMEPATH%\gOEYMkgs\McMS.exe
- %HOMEPATH%\gOEYMkgs\LgcM.exe
- %HOMEPATH%\gOEYMkgs\BgUm.exe
- %HOMEPATH%\gOEYMkgs\mogO.exe
- %HOMEPATH%\gOEYMkgs\ekcI.exe
- %HOMEPATH%\gOEYMkgs\HYwM.exe
- %HOMEPATH%\gOEYMkgs\poog.exe
- %HOMEPATH%\gOEYMkgs\rwEm.exe
- %HOMEPATH%\gOEYMkgs\XgUc.exe
- %HOMEPATH%\gOEYMkgs\LcYI.exe
- %HOMEPATH%\gOEYMkgs\xEsK.exe
- %HOMEPATH%\gOEYMkgs\UEcy.exe
- %HOMEPATH%\gOEYMkgs\bMQu.exe
- %HOMEPATH%\gOEYMkgs\cwsW.exe
- %HOMEPATH%\gOEYMkgs\CYgW.exe
- %HOMEPATH%\gOEYMkgs\dIgI.exe
- %HOMEPATH%\gOEYMkgs\FgQo.exe
- %HOMEPATH%\gOEYMkgs\Jcwu.exe
- %HOMEPATH%\gOEYMkgs\XswI.exe
- %HOMEPATH%\gOEYMkgs\YQsC.exe
- %HOMEPATH%\gOEYMkgs\fMga.exe
- %HOMEPATH%\gOEYMkgs\FsAu.exe
- %HOMEPATH%\gOEYMkgs\skgW.exe
- %HOMEPATH%\gOEYMkgs\hYsM.exe
- %HOMEPATH%\gOEYMkgs\aAcU.exe
- %HOMEPATH%\gOEYMkgs\jQAg.exe
- %HOMEPATH%\gOEYMkgs\zowi.exe
- %HOMEPATH%\gOEYMkgs\RQsA.exe
- %HOMEPATH%\gOEYMkgs\ioge.exe
- %HOMEPATH%\gOEYMkgs\LQsW.exe
- %HOMEPATH%\gOEYMkgs\tgcs.exe
- %HOMEPATH%\gOEYMkgs\uIMs.exe
- %HOMEPATH%\gOEYMkgs\AkUc.exe
- %HOMEPATH%\gOEYMkgs\Ckgg.exe
- %HOMEPATH%\gOEYMkgs\aYgq.exe
- %HOMEPATH%\gOEYMkgs\sgcQ.exe
- %HOMEPATH%\gOEYMkgs\qUMm.exe
- %HOMEPATH%\gOEYMkgs\pYcK.exe
- %HOMEPATH%\gOEYMkgs\PQQk.exe
- %HOMEPATH%\gOEYMkgs\Dcoq.exe
- %HOMEPATH%\gOEYMkgs\cIIm.exe
- %HOMEPATH%\gOEYMkgs\fAIU.exe
- %HOMEPATH%\gOEYMkgs\CYYs.exe
- %HOMEPATH%\gOEYMkgs\YEoq.exe
- %HOMEPATH%\gOEYMkgs\YsYq.exe
- %HOMEPATH%\gOEYMkgs\OsQK.exe
- %HOMEPATH%\gOEYMkgs\moMy.exe
- %HOMEPATH%\gOEYMkgs\FsgW.exe
- %HOMEPATH%\gOEYMkgs\sQMs.exe
- %HOMEPATH%\gOEYMkgs\dIkg.exe
- %HOMEPATH%\gOEYMkgs\fYUs.exe
- %HOMEPATH%\gOEYMkgs\OIQC.exe
- %HOMEPATH%\gOEYMkgs\cQMg.exe
- %HOMEPATH%\gOEYMkgs\PgUk.exe
- %HOMEPATH%\gOEYMkgs\Ykoo.exe
- %TEMP%\myQccEsE.bat
- %HOMEPATH%\gOEYMkgs\EAMk.exe
- %HOMEPATH%\gOEYMkgs\AgkA.exe
- %HOMEPATH%\gOEYMkgs\qAIY.exe
- %HOMEPATH%\gOEYMkgs\bMAi.exe
- %HOMEPATH%\gOEYMkgs\xEMe.exe
- %HOMEPATH%\gOEYMkgs\zcgI.exe
- %HOMEPATH%\gOEYMkgs\ZsQQ.exe
- %HOMEPATH%\gOEYMkgs\NgwQ.exe
- %HOMEPATH%\gOEYMkgs\dsca.exe
- %HOMEPATH%\gOEYMkgs\hMgM.exe
- %HOMEPATH%\gOEYMkgs\RgAY.exe
- %HOMEPATH%\gOEYMkgs\TAQG.exe
- %HOMEPATH%\gOEYMkgs\xwMU.exe
- %HOMEPATH%\gOEYMkgs\KsQu.exe
- %HOMEPATH%\gOEYMkgs\FIIY.exe
- %HOMEPATH%\gOEYMkgs\EAsy.exe
- %HOMEPATH%\gOEYMkgs\xUMM.exe
- %HOMEPATH%\gOEYMkgs\GcQu.exe
- %HOMEPATH%\gOEYMkgs\LgkW.exe
- %HOMEPATH%\gOEYMkgs\dkYU.exe
- %HOMEPATH%\gOEYMkgs\EUIo.exe
- %HOMEPATH%\gOEYMkgs\jAUo.exe
- %HOMEPATH%\gOEYMkgs\xYEc.exe
- %HOMEPATH%\gOEYMkgs\PsMQ.exe
- %HOMEPATH%\gOEYMkgs\tQow.exe
- %HOMEPATH%\gOEYMkgs\RYgq.exe
- %HOMEPATH%\gOEYMkgs\SYco.exe
- %HOMEPATH%\gOEYMkgs\sYoS.exe
- %HOMEPATH%\gOEYMkgs\sEMQ.exe
- %HOMEPATH%\gOEYMkgs\ewEs.exe
- %HOMEPATH%\gOEYMkgs\PEgq.exe
- %HOMEPATH%\gOEYMkgs\kMsg.exe
- %HOMEPATH%\gOEYMkgs\lsUc.exe
- %HOMEPATH%\gOEYMkgs\qsUI.exe
- %HOMEPATH%\gOEYMkgs\iYQo.exe
- %HOMEPATH%\gOEYMkgs\tcAK.exe
- %HOMEPATH%\gOEYMkgs\woAy.exe
- %TEMP%\wsMckYQE.bat
- %HOMEPATH%\gOEYMkgs\zkMi.exe
- %HOMEPATH%\gOEYMkgs\nQkc.exe
- %HOMEPATH%\gOEYMkgs\Aswk.exe
- %HOMEPATH%\gOEYMkgs\JgEA.exe
- %HOMEPATH%\gOEYMkgs\wwYU.exe
- %HOMEPATH%\gOEYMkgs\vAQG.exe
- %HOMEPATH%\gOEYMkgs\yocU.exe
- %HOMEPATH%\gOEYMkgs\fsUY.exe
- %HOMEPATH%\gOEYMkgs\uAIy.exe
- %HOMEPATH%\gOEYMkgs\LokA.exe
- %HOMEPATH%\gOEYMkgs\JMEa.exe
- %HOMEPATH%\gOEYMkgs\Sssa.exe
- %HOMEPATH%\gOEYMkgs\psoa.exe
- %HOMEPATH%\gOEYMkgs\QQIc.exe
- %HOMEPATH%\gOEYMkgs\vcYs.exe
- %HOMEPATH%\gOEYMkgs\NIwk.exe
- %HOMEPATH%\gOEYMkgs\GUEw.exe
- %HOMEPATH%\gOEYMkgs\KkYU.exe
- %HOMEPATH%\gOEYMkgs\ZwcU.exe
- %HOMEPATH%\gOEYMkgs\wQoY.exe
- %HOMEPATH%\gOEYMkgs\MssS.exe
- %HOMEPATH%\gOEYMkgs\CEEI.exe
- %HOMEPATH%\gOEYMkgs\bQwW.exe
- %HOMEPATH%\gOEYMkgs\lsUg.exe
- %HOMEPATH%\gOEYMkgs\nQoq.exe
- %HOMEPATH%\gOEYMkgs\qYUk.exe
- %HOMEPATH%\gOEYMkgs\mUUM.exe
- %HOMEPATH%\gOEYMkgs\rEgu.exe
- %HOMEPATH%\gOEYMkgs\DcwG.exe
- %HOMEPATH%\gOEYMkgs\DoAy.exe
- %HOMEPATH%\gOEYMkgs\tIsI.exe
- %HOMEPATH%\gOEYMkgs\sAky.exe
- %HOMEPATH%\gOEYMkgs\lMEw.exe
- %HOMEPATH%\gOEYMkgs\oQAA.exe
- %HOMEPATH%\gOEYMkgs\TkAG.exe
- %HOMEPATH%\gOEYMkgs\AYAS.exe
- %HOMEPATH%\gOEYMkgs\UkcE.exe
- %HOMEPATH%\gOEYMkgs\oUAM.exe
- %HOMEPATH%\gOEYMkgs\LgIY.exe
- %HOMEPATH%\gOEYMkgs\zwgG.exe
- %HOMEPATH%\gOEYMkgs\TMMa.exe
- %HOMEPATH%\gOEYMkgs\ccEo.exe
- %HOMEPATH%\gOEYMkgs\eAIu.exe
- %HOMEPATH%\gOEYMkgs\rYwC.exe
- %HOMEPATH%\gOEYMkgs\Fscq.exe
- %HOMEPATH%\gOEYMkgs\VkoO.exe
- %HOMEPATH%\gOEYMkgs\RwIu.exe
- %HOMEPATH%\gOEYMkgs\HQAG.exe
- %HOMEPATH%\gOEYMkgs\egUm.exe
- %HOMEPATH%\gOEYMkgs\loMy.exe
- '74.##5.232.51':80
- http://google.com/ via 74.##5.232.51
- http:/// via 74.##5.232.51
- DNS ASK google.com
- ClassName: '' WindowName: 'lacMcYws.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'SSIkQYgQ.exe'