Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %HOMEPATH%\UpBackup\UpdateOffice.exe
Вредоносные функции:
Создает и запускает на исполнение:
- %HOMEPATH%\PrintHood\UpdateOffice.exe
- %HOMEPATH%\UpBackup\UpdateOffice.exe
Запускает на исполнение:
- <SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\pangtip.bat" "
- <SYSTEM32>\ping.exe www.ma##kil.in
- <SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %HOMEPATH%\My Documents\<Имя вируса>.exe.jpg
- <SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\100.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\PrintHood\~JO8uczQeTiRs3hPO9CT8.TMP
- %HOMEPATH%\PrintHood\~U1X1XmQJeLD8lmowKDE0.TMP
- %HOMEPATH%\PrintHood\~BmIPqPsjpbntUIXZusJs.TMP
- %HOMEPATH%\PrintHood\~B4MJvBVd1lB2YDkBBe5o.TMP
- %HOMEPATH%\PrintHood\bT7A2QCFRe.PRI
- %HOMEPATH%\PrintHood\mWVJJo33Le.PRI
- %HOMEPATH%\PrintHood\A26ue3VsLs.PRI
- %HOMEPATH%\PrintHood\hFG16RpQOs.PRI
- %HOMEPATH%\PrintHood\JrlJULSm5N.PRI
- %HOMEPATH%\PrintHood\~pCMLroYEkcZFQW9paZiP.TMP
- %HOMEPATH%\PrintHood\~aY4blzZacjh12yc1bhKO.TMP
- %HOMEPATH%\PrintHood\~8yhZKD4WeF7kdQgo3bZk.TMP
- %HOMEPATH%\PrintHood\~GBoKdSQltDjYcLOpigtA.TMP
- %HOMEPATH%\PrintHood\~4aNBZHhpxmj7E3soVmbD.TMP
- %HOMEPATH%\PrintHood\~mEW4BX5sr74UpbA9nhXc.TMP
- %HOMEPATH%\PrintHood\~6B1P5eVsOrl3OM8IY0og.TMP
- %HOMEPATH%\PrintHood\~CNrCNRe5KCo4yfKo8I96.TMP
- %HOMEPATH%\PrintHood\~VJ28hHOuevj5NXlo2075.TMP
- %HOMEPATH%\PrintHood\~Njd3Uow2HdAYzFXGwICe.TMP
- %HOMEPATH%\PrintHood\UsB2gfik9p.PRI
- %HOMEPATH%\PrintHood\vYVyvGFaS1.PRI
- %HOMEPATH%\PrintHood\JHpJhAZdnM.PRI
- %HOMEPATH%\PrintHood\pUYeKengKL.PRI
- %HOMEPATH%\PrintHood\Wjz803p9JD.PRI
- %HOMEPATH%\PrintHood\21nPcpthMQ.PRI
- %HOMEPATH%\PrintHood\cIyjSmdfUd.PRI
- %HOMEPATH%\PrintHood\vwYOivhkJZ.PRI
- %HOMEPATH%\PrintHood\g7omRMSy1l.PRI
- %HOMEPATH%\PrintHood\fuL49m9BKc.PRI
- %HOMEPATH%\PrintHood\nuHOljim5v.PRI
- %HOMEPATH%\PrintHood\p7P0XonPRW.PRI
- %HOMEPATH%\PrintHood\HLhVzEhABy.PRI
- %HOMEPATH%\PrintHood\nanuWnSXTV.PRI
- %HOMEPATH%\PrintHood\hfRHOJEdM8.PRI
- %HOMEPATH%\PrintHood\Zoi2blRf8O.PRI
- %HOMEPATH%\PrintHood\LDsbxuQh8J.PRI
- %HOMEPATH%\PrintHood\EcxAQ9sG5F.PRI
- %HOMEPATH%\PrintHood\n708W1Emrw.PRI
- %HOMEPATH%\PrintHood\f76NDYYTAg.PRI
- %HOMEPATH%\PrintHood\~HDO14hO5aofS53ar4Pmj.TMP
- %HOMEPATH%\PrintHood\~RvMLniR667JhQaSTbK09.TMP
- %HOMEPATH%\PrintHood\~rJKeWSqEGBWsThA6yqaU.TMP
- %HOMEPATH%\PrintHood\~HvJxHnUyh5bT7063Jqqu.TMP
- %HOMEPATH%\PrintHood\~Ev8ktEGkSUyZqxjxUfsP.TMP
- %HOMEPATH%\PrintHood\~uOadzKq2FazMiOP4muIe.TMP
- %HOMEPATH%\PrintHood\~0MceyCzMSKEYNJyGIJDu.TMP
- %HOMEPATH%\PrintHood\~8fSim4NN7BGcV4j2PwzL.TMP
- %HOMEPATH%\PrintHood\~sEaXMheo2E9Ajhqa62Df.TMP
- %HOMEPATH%\PrintHood\~c2XVKz6DSentWkz7UL1Z.TMP
- %HOMEPATH%\PrintHood\~IFso85p2YE2eu9auGJmo.TMP
- %HOMEPATH%\PrintHood\~FCLm3j4KhvOv8mXlTQPZ.TMP
- %HOMEPATH%\PrintHood\~hrFigtHHAWcDA20qXHf7.TMP
- %HOMEPATH%\PrintHood\~EpIwt2CjSmxdfkb5IZ4f.TMP
- %HOMEPATH%\PrintHood\~JpZVuBav3o7HlOJt9Bmm.TMP
- %HOMEPATH%\PrintHood\~3MY6PFwzlNqIrA48CHtP.TMP
- %HOMEPATH%\PrintHood\~bPmo7gdPg5BAdTg1Bgvt.TMP
- %HOMEPATH%\PrintHood\~UaY2chaoKMdMKIiiWrjA.TMP
- %HOMEPATH%\PrintHood\~DMWWFNX6UWaT139AMeYI.TMP
- %HOMEPATH%\PrintHood\~78jKVyYMqIlEkjk7s8n2.TMP
- %HOMEPATH%\PrintHood\~plWlggMN9cESIDzWKz9m.TMP
- %HOMEPATH%\PrintHood\~F6tL6fGwYFgSwenxJ9Ip.TMP
- %HOMEPATH%\PrintHood\~FI2HFZNJnOTsqIauLAGq.TMP
- %HOMEPATH%\PrintHood\~RiaefaK6o41P1tHBBTaH.TMP
- %HOMEPATH%\PrintHood\~1rbtrfYr8gPToFfZNzoS.TMP
- %HOMEPATH%\PrintHood\~lz9OAARKgzV6X16T1mRo.TMP
- %HOMEPATH%\PrintHood\~8HNUCyz10bIApBe5Q1pJ.TMP
- %HOMEPATH%\PrintHood\~il5iYtIfFJtDwXit7lLD.TMP
- %HOMEPATH%\PrintHood\~GZ64bp09bePuYdFNhCJ2.TMP
- %HOMEPATH%\PrintHood\~4kw4iixLGpXeJhs0ZBwN.TMP
- %HOMEPATH%\PrintHood\~sclOajLl8YLZwCQhi5Os.TMP
- %HOMEPATH%\PrintHood\~4rtn4eU5HHLgWYUytq0v.TMP
- %HOMEPATH%\PrintHood\~Rwd9fLiZ3k0HLPzpL0hX.TMP
- %HOMEPATH%\PrintHood\~JUjQBPk5Hvnc95HU4soy.TMP
- %HOMEPATH%\PrintHood\~9W2cxmTQSuNAhrv4dapU.TMP
- %HOMEPATH%\PrintHood\~yrdgIcDryMK6sRsVfKj2.TMP
- %HOMEPATH%\PrintHood\~1AAyP2AMdev0CR6jqbv7.TMP
- %HOMEPATH%\PrintHood\~rIqrL449rE6VmQqMoVLc.TMP
- %HOMEPATH%\PrintHood\~1vkmvJTbaLDCqp6v5b8m.TMP
- %HOMEPATH%\PrintHood\~pbB3ZMZK0LyMrYfi3DwL.TMP
- %HOMEPATH%\PrintHood\ykdUeBuuOu.PRI
- %HOMEPATH%\PrintHood\rQnYXbAPQz.dll
- %HOMEPATH%\PrintHood\IaLSnXEdxC.dll
- %HOMEPATH%\PrintHood\18vVMox6HD.dll
- %HOMEPATH%\PrintHood\csKobCQRSw.dll
- %HOMEPATH%\PrintHood\zr31ErU4v4.dll
- %HOMEPATH%\PrintHood\tA7duQTpsi.dll
- %HOMEPATH%\PrintHood\PwyqBtBlYl.dll
- %HOMEPATH%\PrintHood\4XRQb6a2ID.dll
- %HOMEPATH%\PrintHood\KzT3OnHm85.dll
- %HOMEPATH%\PrintHood\jM4LYf3XQc.dll
- %HOMEPATH%\PrintHood\OqfEaldg8F.dll
- %HOMEPATH%\PrintHood\uIe3OEXh7G.dll
- %HOMEPATH%\PrintHood\nKAAhkEHsj.dll
- %HOMEPATH%\PrintHood\SGo83IMk7T.dll
- %HOMEPATH%\PrintHood\KD4zA0G3Xc.dll
- %HOMEPATH%\PrintHood\LSAs5wWbRn.dll
- %HOMEPATH%\PrintHood\5eMYFGAjQA.dll
- %HOMEPATH%\PrintHood\DtRA1dCW0b.dll
- %HOMEPATH%\PrintHood\MhVKZYOqjR.dll
- %HOMEPATH%\PrintHood\qMLLBoheB0.dll
- %HOMEPATH%\PrintHood\Budd2KVB0V.dll
- %HOMEPATH%\PrintHood\TpglH1ODTv.dll
- %HOMEPATH%\PrintHood\rsVWUPcDi7.dll
- %HOMEPATH%\PrintHood\SFoLD5jSao.dll
- %HOMEPATH%\PrintHood\bjpnkgDGIa.dll
- %HOMEPATH%\PrintHood\pangtip.bat
- %HOMEPATH%\PrintHood\UPDATE~1.EXE.pkxm
- %HOMEPATH%\PrintHood\lD0EDmZYOu.dll
- %HOMEPATH%\Templates\nam.dll
- %HOMEPATH%\PrintHood\MZqqDpUhq9.dll
- %HOMEPATH%\PrintHood\D8Fg9TLoCG.dll
- %HOMEPATH%\PrintHood\YmtVa2bduj.dll
- %HOMEPATH%\PrintHood\LdqLjXBPOE.dll
- %HOMEPATH%\PrintHood\PWEEK3fUPB.dll
- %HOMEPATH%\PrintHood\KBpp9YblUT.dll
- %HOMEPATH%\PrintHood\r3PmJzPOSA.dll
- %HOMEPATH%\PrintHood\BHIZk8juab.dll
- %HOMEPATH%\PrintHood\a19HHIsIAl.dll
- %HOMEPATH%\PrintHood\YeTUf8gl4J.dll
- %HOMEPATH%\PrintHood\ehzEeINWCs.dll
- %HOMEPATH%\PrintHood\UZlfRgPNU1.PRI
- %HOMEPATH%\PrintHood\uGqhaA9uxg.PRI
- %HOMEPATH%\PrintHood\xPa8cNZvdL.PRI
- %HOMEPATH%\PrintHood\4nWA4h0d54.PRI
- %HOMEPATH%\PrintHood\7zQbmaMaD1.PRI
- %HOMEPATH%\PrintHood\FT4HzBl9cY.PRI
- %HOMEPATH%\PrintHood\DvPwCV9mQx.PRI
- %HOMEPATH%\PrintHood\gvWsqLCXWa.PRI
- %HOMEPATH%\PrintHood\XVeQnOp3Fg.PRI
- %HOMEPATH%\PrintHood\2t8vR52DTC.PRI
- %HOMEPATH%\PrintHood\W54hKgpEVf.PRI
- %HOMEPATH%\PrintHood\Yt9S679LeA.PRI
- %HOMEPATH%\PrintHood\cqjkdmfXeJ.PRI
- %HOMEPATH%\PrintHood\AldmqWXc0b.PRI
- %HOMEPATH%\PrintHood\8z5W9QyC8i.PRI
- %HOMEPATH%\PrintHood\iFbIteUPL4.PRI
- %HOMEPATH%\PrintHood\jBCJNj2Zjj.PRI
- %HOMEPATH%\PrintHood\comzyGpJIg.PRI
- %HOMEPATH%\PrintHood\io7drEEuOj.PRI
- %HOMEPATH%\PrintHood\bfQtspqD0H.PRI
- %HOMEPATH%\PrintHood\PIDG4caM2C.dll
- %HOMEPATH%\PrintHood\JHL4RUullV.dll
- %HOMEPATH%\PrintHood\1Yikvlnl7J.dll
- %HOMEPATH%\PrintHood\b63dfYX20b.dll
- %HOMEPATH%\PrintHood\DpwYfwj5Df.dll
- %HOMEPATH%\PrintHood\OLYyQKY3Xi.dll
- %HOMEPATH%\PrintHood\ux7ds7I5SF.dll
- %HOMEPATH%\PrintHood\JybVKhxCJP.dll
- %HOMEPATH%\PrintHood\tNp1GbACXC.dll
- %HOMEPATH%\PrintHood\kWSN2VYiwF.dll
- %HOMEPATH%\PrintHood\7CUn1JjFpp.PRI
- %HOMEPATH%\PrintHood\1Yiz5nFfeY.PRI
- %HOMEPATH%\PrintHood\qrdRxMqbsc.PRI
- %HOMEPATH%\PrintHood\VLuoQW6mEO.PRI
- %HOMEPATH%\PrintHood\MP7yB7L3rz.PRI
- %HOMEPATH%\PrintHood\bcslvWT00I.dll
- %HOMEPATH%\PrintHood\YM43thEiiE.dll
- %HOMEPATH%\PrintHood\D01eET6G9o.dll
- %HOMEPATH%\PrintHood\Z51pbMpSsZ.dll
- %HOMEPATH%\PrintHood\~fbKmdE7zqfk8m0eXbkVy.TMP
- %HOMEPATH%\PrintHood\~Pyt1Z0cCwzVpPY4NKUqP.TMP
- %HOMEPATH%\PrintHood\~9CmohG2SMnx77kQ7kTa5.TMP
- %HOMEPATH%\PrintHood\~OUwaODKdUTffrrWuTwuU.TMP
- %HOMEPATH%\PrintHood\~QiDdD7sqs6JaV957Tesj.TMP
- %HOMEPATH%\PrintHood\~t1OL1ihc34vYaOfGvYLO.TMP
- %HOMEPATH%\PrintHood\~1ruV1mG6AvBrjHaMcnnd.TMP
- %HOMEPATH%\PrintHood\~lW7Kx6UWWDLLiwJQnuNk.TMP
- %HOMEPATH%\PrintHood\~NYzwr6eiiFiBlBLeYt9N.TMP
- %HOMEPATH%\PrintHood\~euVrO20uFkZzUJy7L98K.TMP
- %HOMEPATH%\PrintHood\~SoJRG9v1ehTJQhnlXRhM.TMP
- %HOMEPATH%\PrintHood\~XuJci0q9O69rPBBjdphj.TMP
- %HOMEPATH%\PrintHood\~MRKVsBfSgOc5cCjooGyq.TMP
- %HOMEPATH%\PrintHood\~MMcailaWEFYs3hB3GHv7.TMP
- %HOMEPATH%\PrintHood\~2X1pcbpjobK3zWnMBZog.TMP
- %HOMEPATH%\PrintHood\~i2Uggk8pT67PXILi55bq.TMP
- %HOMEPATH%\PrintHood\~irkRjEd4wYCo9SkQBVbw.TMP
- %HOMEPATH%\PrintHood\~2QzO5ak8URewDID0fUZC.TMP
- %HOMEPATH%\PrintHood\~vepR3T3Y98eLhDTDZDLg.TMP
- %HOMEPATH%\PrintHood\~19fr07iMXPYOMMEwPPYA.TMP
- %HOMEPATH%\PrintHood\~O8G1DxvQyPuTys7Ue1KV.TMP
- %HOMEPATH%\PrintHood\~pdS6MfHojFewMxwlaMGB.TMP
- %HOMEPATH%\PrintHood\~osvPar9ovIGsAE3Ye0iw.TMP
- %HOMEPATH%\PrintHood\~usdscCIDJQWBY3stI5Iw.TMP
- %HOMEPATH%\PrintHood\~70PQujqxHs8e6K6aNoLy.TMP
- %HOMEPATH%\PrintHood\~jSbayLGs5kZcNaE2VDs3.TMP
- %HOMEPATH%\PrintHood\~EIQxj733r9E5c4wvD2GJ.TMP
- %HOMEPATH%\PrintHood\~R7quyubC3N8KioXNrS8P.TMP
- %HOMEPATH%\PrintHood\~M911EeVwrhcSXrCWdsng.TMP
- %HOMEPATH%\PrintHood\~rGtxrzXrQ6owejnI9VeZ.TMP
- %HOMEPATH%\PrintHood\~KiLAFAHt8r7hu5X4hrvi.TMP
- %HOMEPATH%\PrintHood\~rNx262MOAXKeOpiNI7zB.TMP
- %HOMEPATH%\PrintHood\~MhsSI05brWw869PjTuWi.TMP
- %HOMEPATH%\PrintHood\~LIcRlSJP69ULQFA4AC3N.TMP
- %HOMEPATH%\PrintHood\~O5zpFY6bRhCqAd1TWUSh.TMP
- %HOMEPATH%\PrintHood\~rDZ9cwsZC9xkJjyZx5lI.TMP
- %HOMEPATH%\PrintHood\~5O0rAm3v45j7c5N1fczZ.TMP
- %HOMEPATH%\PrintHood\~9WcwLre9p6IvLaA58RLU.TMP
- %HOMEPATH%\PrintHood\~cRPp1RNc2VnVOwQqnBbP.TMP
- %HOMEPATH%\PrintHood\~vyWzQP5inSUEuznhKgAk.TMP
- %HOMEPATH%\PrintHood\~nuS3KhYR10h5fWFCTBGy.TMP
- %HOMEPATH%\PrintHood\~MtRDLAL7cfNEzTzqXJTT.TMP
- %HOMEPATH%\Recent\<Имя вируса>.exe.lnk
- %HOMEPATH%\PrintHood\xdat.dll
- %HOMEPATH%\PrintHood\~J3SaUfQ0rMYGS6Blyt4I.TMP
- %HOMEPATH%\PrintHood\~Bz9GafViPBjlng8p2nm4.TMP
- %HOMEPATH%\PrintHood\~YfLMmRZcEAs9id805aa0.TMP
- %HOMEPATH%\PrintHood\~luWa8zaKhDPgBTFv6xmu.TMP
- %HOMEPATH%\PrintHood\~A8Jo1jLOfavvkEZjMDYF.TMP
- %HOMEPATH%\PrintHood\100.bat
- %HOMEPATH%\PrintHood\BIE.dll
- %HOMEPATH%\PrintHood\FIE.dll
- %HOMEPATH%\PrintHood\SHK.dll
- %HOMEPATH%\PrintHood\SIK.dll
- %HOMEPATH%\PrintHood\Roze.dll
- %HOMEPATH%\My Documents\<Имя вируса>.exe.jpg
- %HOMEPATH%\PrintHood\UpdateOffice.exe
- %HOMEPATH%\PrintHood\mahdi.txt
- %HOMEPATH%\My Documents\<Имя вируса>.exe.txt
- %HOMEPATH%\PrintHood\~WmBM9MboaCPBpO526YiI.TMP
- %HOMEPATH%\PrintHood\~bH6E1kdiTaGAjx9epYWZ.TMP
- %HOMEPATH%\PrintHood\~H0O71zPKKaUb38vOkYna.TMP
- %HOMEPATH%\PrintHood\~R8KOYby0C28uu01FaKxa.TMP
- %HOMEPATH%\PrintHood\~6jzlyfyPt1z7ewVeZdvA.TMP
- %HOMEPATH%\PrintHood\~wNCIujbaJMYCIq5M1ncb.TMP
- %HOMEPATH%\PrintHood\~sz1lsWwTxQZkHgzNEh9Y.TMP
- %HOMEPATH%\PrintHood\~5Ec94zEPQE5iIU5JxPXR.TMP
- %HOMEPATH%\PrintHood\~S36Hr9u11m2y5PP2mMog.TMP
- %HOMEPATH%\PrintHood\~wZRxZsbmSyfgZVjFlJFf.TMP
- %HOMEPATH%\PrintHood\~qVE8V7kZx8QLSIXoz3rw.TMP
- %HOMEPATH%\PrintHood\~gnInhTdskKOqCMUHGxni.TMP
- %HOMEPATH%\PrintHood\~LpPo4otBlKnux2n0Toog.TMP
- %HOMEPATH%\PrintHood\~UpdjxSjrQQJco4thhHbO.TMP
- %HOMEPATH%\PrintHood\~sdBSjzkBQzGBr5JyYe9t.TMP
- %HOMEPATH%\PrintHood\~ObEh663Gp1GrAxmnUpDE.TMP
- %HOMEPATH%\PrintHood\~PgrYXeJcoTRWP9VZcHnR.TMP
- %HOMEPATH%\PrintHood\~BmbzXA8dfK5zkCramClI.TMP
- %HOMEPATH%\PrintHood\~0LA130VnWyCVsr11JdSk.TMP
- %HOMEPATH%\PrintHood\~UNe23teVYMbVQOYZvsns.TMP
- %HOMEPATH%\PrintHood\~O5GEhgtAwPTZfkZFTvLR.TMP
- %HOMEPATH%\PrintHood\~bE2fj97riPXLXzZYdkr4.TMP
- %HOMEPATH%\PrintHood\~QtgbocY52QcQ2w3F8rjS.TMP
- %HOMEPATH%\PrintHood\~pApbbmVVXVzQtNgc4BjV.TMP
- %HOMEPATH%\PrintHood\~pojII6TsjnnigevPGVbT.TMP
- %HOMEPATH%\PrintHood\~EKEQqgYF7dvi4pq1NTxt.TMP
- %HOMEPATH%\PrintHood\~hGP69eXWHvBSm5wAzDHE.TMP
- %HOMEPATH%\PrintHood\~87zv0dODiuXJX4CXejVS.TMP
- %HOMEPATH%\PrintHood\~TnQK0ZEyeMzmG2xvSfvz.TMP
- %HOMEPATH%\PrintHood\~pF4FNTAO193TMgWxeKTZ.TMP
- %HOMEPATH%\PrintHood\~OAtF0HItEfu5znM2AtxJ.TMP
- %HOMEPATH%\PrintHood\~WZO9nS86SDAZmQeXkyZn.TMP
- %HOMEPATH%\PrintHood\~IID3SA6RjzXSRhIAYpLP.TMP
- %HOMEPATH%\PrintHood\~hi3B78nX9khQw1uh8XLL.TMP
- %HOMEPATH%\PrintHood\~xuS54dpXkmyJsbH5CxYI.TMP
- %HOMEPATH%\PrintHood\~ttTecHSgGIdveyf9hMw4.TMP
- %HOMEPATH%\PrintHood\~8fzqRgmP9dBwak5OSJ4U.TMP
- %HOMEPATH%\PrintHood\~pYn6QXz7lNDW8uUSBGHn.TMP
- %HOMEPATH%\PrintHood\~nZX5fFThQZMvHFWXF4so.TMP
- %HOMEPATH%\PrintHood\~Yu4MoaDT0fZQ69r2wnwR.TMP
- %HOMEPATH%\PrintHood\~ZKskSdyg5Z9TnZp4nRqt.TMP
- %HOMEPATH%\PrintHood\~IW0XunByQPoB6imnNfzL.TMP
- %HOMEPATH%\PrintHood\~YgETn9nPomXyU0xae4uj.TMP
- %HOMEPATH%\PrintHood\~BvqUeeiiNsJyUOPv0H6z.TMP
- %HOMEPATH%\PrintHood\~xCk2cuTQOJGpqWhLhV1f.TMP
- %HOMEPATH%\PrintHood\~DAvqQq8F02hf0NTtN1iO.TMP
- %HOMEPATH%\PrintHood\~VcMhumaZ8iJgEwPOIKyT.TMP
- %HOMEPATH%\PrintHood\~rj8NcvPZTWTfpkGyc0jv.TMP
- %HOMEPATH%\PrintHood\~3al6GLhMGFV0mn7zRp8E.TMP
- %HOMEPATH%\PrintHood\~z8dWfe004NN1IjZKczyJ.TMP
- %HOMEPATH%\PrintHood\~Z5kHmblbuTe19TxnRqOT.TMP
- %HOMEPATH%\PrintHood\~I8LADv3yssCTuxupK58J.TMP
- %HOMEPATH%\PrintHood\~NzcULAKjokBCSgW1CcTD.TMP
- %HOMEPATH%\PrintHood\~VmeD7ZYY9lGFppiWt8As.TMP
- %HOMEPATH%\PrintHood\~T5AnFk0jW9T9e8E8uBg8.TMP
- %HOMEPATH%\PrintHood\~muc9YYHblvAlAm7Rjlkl.TMP
- %HOMEPATH%\PrintHood\~vrVYB1klgTqwlWFrOHWE.TMP
- %HOMEPATH%\PrintHood\~QFuyodeiqXL7NFYwS9wX.TMP
- %HOMEPATH%\PrintHood\~btl6D4vcMR4UcpkmZR6y.TMP
- %HOMEPATH%\PrintHood\~dIrtbNI196AlxEUrrP6M.TMP
- %HOMEPATH%\PrintHood\~rVQzC12nSyt7JrmmNNxL.TMP
- %HOMEPATH%\PrintHood\~3yoSmNOGO6AavnfzyImw.TMP
- %HOMEPATH%\PrintHood\~mftwBkIiYFaEVfaKDzA0.TMP
- %HOMEPATH%\PrintHood\~NNos1sbnT0Mui6FujFNl.TMP
- %HOMEPATH%\PrintHood\~wsBw5Ct3XMsJgT0ONEgA.TMP
- %HOMEPATH%\PrintHood\~moYvZJadkbPxMtUvI3Aj.TMP
- %HOMEPATH%\PrintHood\~vxwn3yXuioCtoyjiRrbR.TMP
- %HOMEPATH%\PrintHood\~nDOcmhNlr4e6G2IKQOzO.TMP
- %HOMEPATH%\PrintHood\~fmeJdmQwugmOXlPAsslI.TMP
- %HOMEPATH%\PrintHood\~waTyppxcCP0dNE2FN1My.TMP
- %HOMEPATH%\PrintHood\~svogSVVF9z1N28mYltNI.TMP
- %HOMEPATH%\PrintHood\~rL67elyL830LfnOHLnQ9.TMP
- %HOMEPATH%\PrintHood\~KvQ7l5HnPGzP3T9ygJwJ.TMP
- %HOMEPATH%\PrintHood\~2e8yXF77SvSElUxHOhks.TMP
- %HOMEPATH%\PrintHood\~vpW4JsPfjfUaj9bG9Pm3.TMP
- %HOMEPATH%\PrintHood\~FHitcOfav3FFxhfWrvYt.TMP
- %HOMEPATH%\PrintHood\~jdjaT95osdICntnpOfwt.TMP
- %HOMEPATH%\PrintHood\~ZVBRvS6gq6gKRs6P5fgW.TMP
- %HOMEPATH%\PrintHood\~9VdRM0RzDAsxxEp0WROE.TMP
- %HOMEPATH%\PrintHood\~BT56Ky0MilfWiHQY2q8i.TMP
- %HOMEPATH%\PrintHood\~Z5dC2eQaC0Dby1SHHFK1.TMP
- %HOMEPATH%\PrintHood\~bqubv9svBgLy1aMJsMa0.TMP
- %HOMEPATH%\PrintHood\~J9vbXul75ZCcCAY5I9aa.TMP
- %HOMEPATH%\PrintHood\~KoCj0CMiE8Lj5PFvCEuk.TMP
- %HOMEPATH%\PrintHood\~QRwgZIOosCF1tIgReI8f.TMP
- %HOMEPATH%\PrintHood\~N3gHcw7AErgiXCmKCyhB.TMP
- %HOMEPATH%\PrintHood\~U0DUl9ah7o1LWylEyYYu.TMP
- %HOMEPATH%\PrintHood\~yyqroRYf0dfLOdmjRPYm.TMP
- %HOMEPATH%\PrintHood\~ITumNoMbnadb33CsD9oD.TMP
- %HOMEPATH%\PrintHood\~u8I1gUuU8TU4U0T8NFok.TMP
- %HOMEPATH%\PrintHood\~5vPTjQYPEevhQQelsBZY.TMP
- %HOMEPATH%\PrintHood\~UzrVWqANZuhsqy5ph69j.TMP
- %HOMEPATH%\PrintHood\~9etO70vLViGwfa9pYsll.TMP
- %HOMEPATH%\PrintHood\~EfxmabE9QpbAWxNlcqa5.TMP
- %HOMEPATH%\PrintHood\~PlDvoGdTlI9rBY8XoeIc.TMP
- %HOMEPATH%\PrintHood\~yxxVunoHX3ozFlyozxVc.TMP
- %HOMEPATH%\PrintHood\~RSgIcNu6B0xFh16XbTcV.TMP
- %HOMEPATH%\PrintHood\~EegMmM5zj3q0S1SXeDjX.TMP
- %HOMEPATH%\PrintHood\~sFuW8uHO503UJrAambKb.TMP
- %HOMEPATH%\PrintHood\~VTArgGojcvu1kUC5AA4r.TMP
Удаляет следующие файлы:
- %HOMEPATH%\PrintHood\pangtip.bat
- %HOMEPATH%\My Documents\<Имя вируса>.exe.txt
Сетевая активность:
Подключается к:
- 'localhost':1036
UDP:
- DNS ASK www.ma##kil.in
- '<IP-адрес в локальной сети>':1035
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'http://www.majakil.in/ - u!u!u!u! - Microsoft Internet Explorer'
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: 'u!u!u!u! - Microsoft Internet Explorer'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
- ClassName: '' WindowName: 'http://www.majakil.in/ - u!u!u!u! - Windows Internet Explorer'
- ClassName: '' WindowName: 'u!u!u!u! - Windows Internet Explorer'
