Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %HOMEPATH%\Windows\UpdateOffice.exe
Вредоносные функции:
Создает и запускает на исполнение:
- %HOMEPATH%\PrintHood\UpdateOffice.exe
- %HOMEPATH%\Windows\UpdateOffice.exe
Запускает на исполнение:
- <SYSTEM32>\ping.exe 174.142.57.29
- <SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\pangtip.bat" "
- <SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\700.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\PrintHood\~yCd4jLUeH8pwu27jMlv0.TMP
- %HOMEPATH%\PrintHood\Gkw73KgdwT.PRI
- %HOMEPATH%\PrintHood\~C9BgnnWoJULQXkkHhNzK.TMP
- %HOMEPATH%\PrintHood\~oA2z64BDzdTW7Q8DXQgD.TMP
- %HOMEPATH%\PrintHood\9A8q5M7Y9u.PRI
- %HOMEPATH%\PrintHood\3ZDtcDqWoJ.PRI
- %HOMEPATH%\PrintHood\KqlERU6c0o.PRI
- %HOMEPATH%\PrintHood\9uDvSolYf9.PRI
- %HOMEPATH%\PrintHood\UgplSmPBcn.PRI
- %HOMEPATH%\PrintHood\~6KGU0dPKdO8vfRPoVVnC.TMP
- %HOMEPATH%\PrintHood\~unO3Z9xyyhvIIJxqNCY7.TMP
- %HOMEPATH%\PrintHood\~BExQgXtPX1UHxbn0LxkR.TMP
- %HOMEPATH%\PrintHood\~2IaIaxffBFGa51WkHWo7.TMP
- %HOMEPATH%\PrintHood\~vhfsQ1xC7c9V334JJhdw.TMP
- %HOMEPATH%\PrintHood\~ySREgPQfNqNfaDfnOgSY.TMP
- %HOMEPATH%\PrintHood\~tYwyuLQEPSLCH4qhDggh.TMP
- %HOMEPATH%\PrintHood\~O2hNxeFlBPp3VxmngR6i.TMP
- %HOMEPATH%\PrintHood\~7rswZ2n86EBJNbhgIadq.TMP
- %HOMEPATH%\PrintHood\~yq9yn4s10t8KnpYX0tVn.TMP
- %HOMEPATH%\PrintHood\53AudRORdA.PRI
- %HOMEPATH%\PrintHood\42kvGz4brM.PRI
- %HOMEPATH%\PrintHood\rLdqKlCrXP.PRI
- %HOMEPATH%\PrintHood\B82tlbicb0.PRI
- %HOMEPATH%\PrintHood\TH21yUe1Mx.PRI
- %HOMEPATH%\PrintHood\zanLWxu3Xv.PRI
- %HOMEPATH%\PrintHood\wJ67HIOhkQ.PRI
- %HOMEPATH%\PrintHood\haUtGEDn5o.PRI
- %HOMEPATH%\PrintHood\quHEDHMQRr.PRI
- %HOMEPATH%\PrintHood\JD1hdIg4N7.PRI
- %HOMEPATH%\PrintHood\fA4RwFjrJZ.PRI
- %HOMEPATH%\PrintHood\4Ij4TyXuaq.PRI
- %HOMEPATH%\PrintHood\WlzsAaOKoX.PRI
- %HOMEPATH%\PrintHood\xRMgx9bkDN.PRI
- %HOMEPATH%\PrintHood\dPK0qRNNbx.PRI
- %HOMEPATH%\PrintHood\Yr0dC5zmyj.PRI
- %HOMEPATH%\PrintHood\chWC16vcnO.PRI
- %HOMEPATH%\PrintHood\barC0I0dwv.PRI
- %HOMEPATH%\PrintHood\jeIuIelKrA.PRI
- %HOMEPATH%\PrintHood\jaIeKdWIxu.PRI
- %HOMEPATH%\PrintHood\~UPTQcL08mBa8a7qOVTXw.TMP
- %HOMEPATH%\PrintHood\~zTiqCwiquXNJkGkLKyrp.TMP
- %HOMEPATH%\PrintHood\~uLv9WwIHi4C3TtdBsjPT.TMP
- %HOMEPATH%\PrintHood\~at3XvtBViAnmYRYPQWY2.TMP
- %HOMEPATH%\PrintHood\~zjyYFxnkNDZamMz93GI2.TMP
- %HOMEPATH%\PrintHood\~F75UGu2uGXki3iDyU3O8.TMP
- %HOMEPATH%\PrintHood\~EgPZeXDeezScxWxLjK95.TMP
- %HOMEPATH%\PrintHood\~RcnbgDi42a1bJzub8zEo.TMP
- %HOMEPATH%\PrintHood\~vqYvDJPX4y1uywGKyPxV.TMP
- %HOMEPATH%\PrintHood\~u3Vzkczgipo2ZcQTZegw.TMP
- %HOMEPATH%\PrintHood\~1WVIf5buemFMiAVq1yJ0.TMP
- %HOMEPATH%\PrintHood\~9yGyUEmJluoYAXPRcFfS.TMP
- %HOMEPATH%\PrintHood\~W5IAzfzcU2oBDTYAKg2k.TMP
- %HOMEPATH%\PrintHood\~wwnhiPIdiq4mDQpXALdL.TMP
- %HOMEPATH%\PrintHood\~FWpFDgVunvpLD7mR7Tsy.TMP
- %HOMEPATH%\PrintHood\~LNd2B0vdQKBUiX2wa07z.TMP
- %HOMEPATH%\PrintHood\~ngYgOmU7mNsy6GWt2N2Y.TMP
- %HOMEPATH%\PrintHood\~yXXRphs3omzSuA4vyVyA.TMP
- %HOMEPATH%\PrintHood\~ofVl4zRheYEr0Vw4udNA.TMP
- %HOMEPATH%\PrintHood\~j0wffyxrHkQXlju5DDb6.TMP
- %HOMEPATH%\PrintHood\~zgKJyFlzXskJTnkPnCrk.TMP
- %HOMEPATH%\PrintHood\~BmMfPULEI0Aw6iyQ38Vg.TMP
- %HOMEPATH%\PrintHood\~GfCBbTmjsUl8b82kslVI.TMP
- %HOMEPATH%\PrintHood\~1daaI2kHkYfzHDLKKUKe.TMP
- %HOMEPATH%\PrintHood\~WOoiB1RY75tOP9GpXwNU.TMP
- %HOMEPATH%\PrintHood\~PWtCQibeCxZTdFVN7mo3.TMP
- %HOMEPATH%\PrintHood\~xeiFcy1Y0mV0EDC1P4EE.TMP
- %HOMEPATH%\PrintHood\~kd2uInR1PsMRucPAISPu.TMP
- %HOMEPATH%\PrintHood\~KNXcDDqGGb8GE4M9Q8zt.TMP
- %HOMEPATH%\PrintHood\~EYs9Eob1uH3aQk1mtmeN.TMP
- %HOMEPATH%\PrintHood\~P3rvT10qYcmO4G39yFbk.TMP
- %HOMEPATH%\PrintHood\~TRXllyv9RXPwueYbymmF.TMP
- %HOMEPATH%\PrintHood\~6IMLQF19jkNynTP2zwTZ.TMP
- %HOMEPATH%\PrintHood\~UlKE6JVjjynM3o3dinmr.TMP
- %HOMEPATH%\PrintHood\~ITXGHUCVpr3uHhQBU589.TMP
- %HOMEPATH%\PrintHood\~hFBXWgN9DdHhF1Ccg8ID.TMP
- %HOMEPATH%\PrintHood\~AMbsk2rTLfXhgueokN6l.TMP
- %HOMEPATH%\PrintHood\~jZlrh0ztEs9amFXpcrqS.TMP
- %HOMEPATH%\PrintHood\~Vdldz2RqD9BJKPnvMt9i.TMP
- %HOMEPATH%\PrintHood\85T8N7wTOt.PRI
- %HOMEPATH%\PrintHood\C0yKYZTam2.dll
- %HOMEPATH%\PrintHood\isT0vSWVOb.dll
- %HOMEPATH%\PrintHood\MGdw0SDJsK.dll
- %HOMEPATH%\PrintHood\g1Pw02bcBh.dll
- %HOMEPATH%\PrintHood\MzdNfIPNDN.dll
- %HOMEPATH%\PrintHood\sCtFUWESvF.dll
- %HOMEPATH%\PrintHood\QaqMmEPo3V.dll
- %HOMEPATH%\PrintHood\4vbFyIOIHe.dll
- %HOMEPATH%\PrintHood\URlv0lmkbL.dll
- %HOMEPATH%\PrintHood\onTXT0vUn2.dll
- %HOMEPATH%\PrintHood\ZuGlIzbE4N.dll
- %HOMEPATH%\PrintHood\Bd1w51MJJf.dll
- %HOMEPATH%\PrintHood\gQZqv3gZSt.dll
- %HOMEPATH%\PrintHood\LoQCDIcxGl.dll
- %HOMEPATH%\PrintHood\tZZgBa91yo.dll
- %HOMEPATH%\PrintHood\v9CuGTbeKT.dll
- %HOMEPATH%\PrintHood\jcPViriDyX.dll
- %HOMEPATH%\PrintHood\JWzbYBHPyv.dll
- %HOMEPATH%\PrintHood\Xv5uc9DjM3.dll
- %HOMEPATH%\PrintHood\VdIkW9kPfV.dll
- %HOMEPATH%\PrintHood\6XCX5png3y.dll
- %HOMEPATH%\PrintHood\QA0hc76tlP.dll
- %HOMEPATH%\PrintHood\cPmHfSyUos.dll
- %HOMEPATH%\PrintHood\kXuozDSpRa.dll
- %HOMEPATH%\PrintHood\aT0TcCjBlx.dll
- %HOMEPATH%\PrintHood\pangtip.bat
- %HOMEPATH%\PrintHood\UPDATE~1.EXE.pkxm
- %HOMEPATH%\PrintHood\JY2gVhn8nH.dll
- %HOMEPATH%\Templates\nam.dll
- %HOMEPATH%\PrintHood\ISqLBAVfs9.dll
- %HOMEPATH%\PrintHood\QjD4hUoksK.dll
- %HOMEPATH%\PrintHood\xi90yKaNbk.dll
- %HOMEPATH%\PrintHood\ve4ty4Vzar.dll
- %HOMEPATH%\PrintHood\6o3wuj9gXI.dll
- %HOMEPATH%\PrintHood\RR1yzCl1LF.dll
- %HOMEPATH%\PrintHood\rTaX7N7H1n.dll
- %HOMEPATH%\PrintHood\bfxi6yjtq1.dll
- %HOMEPATH%\PrintHood\26enajMNUj.dll
- %HOMEPATH%\PrintHood\WPH1KjfeoH.dll
- %HOMEPATH%\PrintHood\3RLyQrYf47.PRI
- %HOMEPATH%\PrintHood\s2T9YasiDK.PRI
- %HOMEPATH%\PrintHood\K8aZgtzj6K.PRI
- %HOMEPATH%\PrintHood\mUx3ENXU8C.PRI
- %HOMEPATH%\PrintHood\dDEeYfheIC.PRI
- %HOMEPATH%\PrintHood\3pxnKUCoHK.PRI
- %HOMEPATH%\PrintHood\A36OmPsvYC.PRI
- %HOMEPATH%\PrintHood\G39rzjvC2X.PRI
- %HOMEPATH%\PrintHood\kWnhCwb3Fz.PRI
- %HOMEPATH%\PrintHood\eMupKkkYI4.PRI
- %HOMEPATH%\PrintHood\4m812FUExS.PRI
- %HOMEPATH%\PrintHood\vsFXMOsFIP.PRI
- %HOMEPATH%\PrintHood\Ij4vqdkQe0.PRI
- %HOMEPATH%\PrintHood\ihWc8YXvL5.PRI
- %HOMEPATH%\PrintHood\9iThcX4o0e.PRI
- %HOMEPATH%\PrintHood\tJiqHtJ60J.PRI
- %HOMEPATH%\PrintHood\URJdXRH5Fj.PRI
- %HOMEPATH%\PrintHood\om9VTUaljr.PRI
- %HOMEPATH%\PrintHood\r8EB1DVlFC.PRI
- %HOMEPATH%\PrintHood\zSRsXOfp7b.PRI
- %HOMEPATH%\PrintHood\Q0eCaBPE1G.dll
- %HOMEPATH%\PrintHood\k4bep6hqX5.dll
- %HOMEPATH%\PrintHood\Iy8HFXBnST.dll
- %HOMEPATH%\PrintHood\mvRWGPWh1T.dll
- %HOMEPATH%\PrintHood\CErvQf8U5H.dll
- %HOMEPATH%\PrintHood\MnWei3KWVI.dll
- %HOMEPATH%\PrintHood\w46vVZHsrP.dll
- %HOMEPATH%\PrintHood\eEfL8KgW71.dll
- %HOMEPATH%\PrintHood\gdi8fAXEwh.dll
- %HOMEPATH%\PrintHood\oYWSNYTDd7.dll
- %HOMEPATH%\PrintHood\iFu7jOQAfu.PRI
- %HOMEPATH%\PrintHood\Xf4TZ1jSSR.PRI
- %HOMEPATH%\PrintHood\ZQpFrn3TuM.PRI
- %HOMEPATH%\PrintHood\XE8976mt8v.PRI
- %HOMEPATH%\PrintHood\iw2W8d0bIj.dll
- %HOMEPATH%\PrintHood\lZ4FsGTo0k.dll
- %HOMEPATH%\PrintHood\8ZdSRtLjxk.dll
- %HOMEPATH%\PrintHood\38tS2gVtKT.dll
- %HOMEPATH%\PrintHood\z6kU46xCBz.dll
- %HOMEPATH%\PrintHood\~alWiNYGm4QuGs2ZdjhnC.TMP
- %HOMEPATH%\PrintHood\~3JDUaS771r4B1Xp1PCv8.TMP
- %HOMEPATH%\PrintHood\~eegbZvxPIbC7rhFSxhYn.TMP
- %HOMEPATH%\PrintHood\~6hQF4PdQt1rQbQaqpI18.TMP
- %HOMEPATH%\PrintHood\~Dv4KmzVvUm5SqLN3B519.TMP
- %HOMEPATH%\PrintHood\~NB2bCcVi3RbshPRgB0kA.TMP
- %HOMEPATH%\PrintHood\~w2tHjNjhacF4B15blewU.TMP
- %HOMEPATH%\PrintHood\~cGB2ai3Oqae6lMbpZALj.TMP
- %HOMEPATH%\PrintHood\~2MSqzX75OpxQKKWzTm0O.TMP
- %HOMEPATH%\PrintHood\~sYbVwc1PTSf656MKNfGf.TMP
- %HOMEPATH%\PrintHood\~wpIZLQGumHRAXQbNgWgK.TMP
- %HOMEPATH%\PrintHood\~2GdKkjkoDhLQeriJ76TM.TMP
- %HOMEPATH%\PrintHood\~CfjfJHVrqyM4d4mHnTOh.TMP
- %HOMEPATH%\PrintHood\~CgP4OzQGr7CCErYtdoRU.TMP
- %HOMEPATH%\PrintHood\~TuscuRPYSXre7CYLPQS0.TMP
- %HOMEPATH%\PrintHood\~EMH58ZFGbCt3wTKeJhNu.TMP
- %HOMEPATH%\PrintHood\~ynPkbeotUJh227iQ9ZqH.TMP
- %HOMEPATH%\PrintHood\~vQbhqPkRosWqnnpuT2Km.TMP
- %HOMEPATH%\PrintHood\~2DyF7HcdL3eSuzSNNFI7.TMP
- %HOMEPATH%\PrintHood\~zvi3RKZJtMLkdanBFzPU.TMP
- %HOMEPATH%\PrintHood\~7zNJL8KuZYGSc4j9Bkad.TMP
- %HOMEPATH%\PrintHood\~XJhW6i1uLavSWiQXMot2.TMP
- %HOMEPATH%\PrintHood\~WxefJJEEw98JEghJRLMe.TMP
- %HOMEPATH%\PrintHood\~tKv9UcfThndHCdLrQJ2H.TMP
- %HOMEPATH%\PrintHood\~QB72KEcc9Dl8SGUeUgwv.TMP
- %HOMEPATH%\PrintHood\~XGDAxVe9FXsEX10IkBnl.TMP
- %HOMEPATH%\PrintHood\~77ELsU8xogSWFjqsKdHJ.TMP
- %HOMEPATH%\PrintHood\~KarF4YItJEzhjR9zvJa2.TMP
- %HOMEPATH%\PrintHood\~RIN1Z7RbU3zsJeRUDLib.TMP
- %HOMEPATH%\PrintHood\~4R8BITzHQyIbrkkLaH78.TMP
- %HOMEPATH%\PrintHood\~UL45jr4ieSI9W7ND68i5.TMP
- %HOMEPATH%\PrintHood\~VbmQOTVtrWjjGBcO0sKB.TMP
- %HOMEPATH%\PrintHood\~yffySTGCH8GCeAxoThbU.TMP
- %HOMEPATH%\PrintHood\~PwQU6HQahe9R1nTBF9rT.TMP
- %HOMEPATH%\PrintHood\~Yrc444uupz9crzBmAjzL.TMP
- %HOMEPATH%\PrintHood\~n4Ww856CWX85A9hBW47V.TMP
- %HOMEPATH%\PrintHood\~YgV67EZGPVzrDScCEVUI.TMP
- %HOMEPATH%\PrintHood\~Fs703ZPOHapsdoCkjBdE.TMP
- %HOMEPATH%\PrintHood\~XJu7ZYhvZt1UiPcFTfGE.TMP
- %HOMEPATH%\PrintHood\~n1mfmEg0Emv0kusSxWSR.TMP
- %HOMEPATH%\PrintHood\~IwlXhAvtaznqR1MGDLIC.TMP
- %HOMEPATH%\PrintHood\~UFCzq7aLrfcXJvVEv1TW.TMP
- %HOMEPATH%\PrintHood\~RfebY9aoYerDRckbUfre.TMP
- %HOMEPATH%\PrintHood\~v1Bu9BPhAYdzsuiQIgwK.TMP
- %HOMEPATH%\PrintHood\~jd3iZ2XF6WHkWwfXJD9b.TMP
- %HOMEPATH%\PrintHood\~ndIZgKjCJ7nvnePNlOmL.TMP
- %HOMEPATH%\PrintHood\~J6e6EwHiszXZoHlBkYsP.TMP
- %HOMEPATH%\PrintHood\~NsYonAxStL5pKxnYJNzD.TMP
- %HOMEPATH%\PrintHood\~mHMNNVyeUwEIbNaLOAGn.TMP
- %HOMEPATH%\PrintHood\Motahare.txt
- %HOMEPATH%\PrintHood\<Имя вируса>.exe.txt
- %HOMEPATH%\PrintHood\Shenik.dll
- %HOMEPATH%\PrintHood\Sitikatik.dll
- %HOMEPATH%\PrintHood\<Имя вируса>.exe.pdf
- %HOMEPATH%\PrintHood\datikal.dll
- %HOMEPATH%\PrintHood\~c7fLk48Ry2z5154HQg8H.TMP
- %HOMEPATH%\PrintHood\UpdateOffice.exe
- %HOMEPATH%\PrintHood\700.bat
- %HOMEPATH%\PrintHood\~GF7jG7Guex0w1cPVxA7C.TMP
- %HOMEPATH%\PrintHood\~H7EPIMXOyYPmx4zn72QR.TMP
- %HOMEPATH%\PrintHood\~cioPDEKJOwc8kWko8KsI.TMP
- %HOMEPATH%\PrintHood\~6GOVRM7anC3jVrU11DFh.TMP
- %HOMEPATH%\PrintHood\~9DoPxMNhkv8Jxt7mULjI.TMP
- %HOMEPATH%\PrintHood\~HfBL9iG9k2HInRpPkizR.TMP
- %HOMEPATH%\PrintHood\~DKyNCq2ssjTnTVjM3fqS.TMP
- %HOMEPATH%\PrintHood\~KX7TkCxJeZgIqrLLygU3.TMP
- %HOMEPATH%\PrintHood\~VQZumudLFfCgD04f6VQ7.TMP
- %HOMEPATH%\PrintHood\~4bTmAmYbDT05TQF5mIRG.TMP
- %HOMEPATH%\PrintHood\~qmxLbx7DxeeA7UGfi8X2.TMP
- %HOMEPATH%\PrintHood\~xloebqnKOwBBIaHnZ4bN.TMP
- %HOMEPATH%\PrintHood\~6Lb2joLsw6N8Ag3edZnz.TMP
- %HOMEPATH%\PrintHood\~uvlvX76QJeR0sOUSjMDN.TMP
- %HOMEPATH%\PrintHood\~6xaTk3x5I0bCxEygnAkW.TMP
- %HOMEPATH%\PrintHood\~fsR2RJFlMbvmD58rZaXE.TMP
- %HOMEPATH%\PrintHood\~wh8LdUYmnB4lh441jONM.TMP
- %HOMEPATH%\PrintHood\~Fk5CzUq4m8g9Vdjn0cck.TMP
- %HOMEPATH%\PrintHood\~h7F8Xm3S9MddoerVofdG.TMP
- %HOMEPATH%\PrintHood\~9Zr8LAINawPFCKv4PPdR.TMP
- %HOMEPATH%\PrintHood\~AVfqTqSzUTmYbfzn2RBo.TMP
- %HOMEPATH%\PrintHood\~UGJZpDDeQeJsY2USaAMX.TMP
- %HOMEPATH%\PrintHood\~iYLubjRiuhGIvFO8nHi2.TMP
- %HOMEPATH%\PrintHood\~RCIhHAnNNfQxNuR8Ryfj.TMP
- %HOMEPATH%\PrintHood\~SxAS8fPWG4Lwdmc5EYOe.TMP
- %HOMEPATH%\PrintHood\~0CF8cnpp8N7AUCMMMEea.TMP
- %HOMEPATH%\PrintHood\~oiaxhM3xn7qbgC9pvtm4.TMP
- %HOMEPATH%\PrintHood\~jh5nWawyd1QuGT9tDmdL.TMP
- %HOMEPATH%\PrintHood\~p80aAlPYNU2H5pcP6F3h.TMP
- %HOMEPATH%\PrintHood\~xlI5wGG1h1icTQf2JMa7.TMP
- %HOMEPATH%\PrintHood\~jKTLVSc9X424wv64Lfbi.TMP
- %HOMEPATH%\PrintHood\~jpjQ8VA0TFxUDy9MWFoK.TMP
- %HOMEPATH%\PrintHood\~swoGeBUCyozNJ1nLv9zt.TMP
- %HOMEPATH%\PrintHood\~g5EOVbCv6HUjAU6MceOy.TMP
- %HOMEPATH%\PrintHood\~ZpubZs0Y2NHKug1JsnxJ.TMP
- %HOMEPATH%\PrintHood\~nP2shV7CrM8TT1wbndWo.TMP
- %HOMEPATH%\PrintHood\~wlRsnK78gnR7EovIDyPI.TMP
- %HOMEPATH%\PrintHood\~JFJPV3iGcf7q3qk0KoDa.TMP
- %HOMEPATH%\PrintHood\~ZX1BuaV2V8YLEEaW3CUk.TMP
- %HOMEPATH%\PrintHood\~2NUSHa86cLBjpGaz9cC5.TMP
- %HOMEPATH%\PrintHood\~ltxNWwrGEAqLYKmPrHvz.TMP
- %HOMEPATH%\PrintHood\~Bojrc6YY45Qv6mvrAG6s.TMP
- %HOMEPATH%\PrintHood\~F6GwJwAP9FkVqYbqui4c.TMP
- %HOMEPATH%\PrintHood\~i10OJA724FsLf2dWEVaE.TMP
- %HOMEPATH%\PrintHood\~mW84zhewFXYkz2zGEC9t.TMP
- %HOMEPATH%\PrintHood\~YtB88mHDJzt7KBqYFG6Q.TMP
- %HOMEPATH%\PrintHood\~Tm5R6sUNjuKGKcZQ5biv.TMP
- %HOMEPATH%\PrintHood\~HP6rbsbfpBKlfuyYSY1Z.TMP
- %HOMEPATH%\PrintHood\~K96Nm6l0xUlvJxqBG3Fo.TMP
- %HOMEPATH%\PrintHood\~GzHop3vqjnT3p91WJI4S.TMP
- %HOMEPATH%\PrintHood\~AorVB9Ck7wfMkIvkT1xs.TMP
- %HOMEPATH%\PrintHood\~shmInNcVzylAOZzUVBIs.TMP
- %HOMEPATH%\PrintHood\~zq7seuJC7I6KwmFcBBv4.TMP
- %HOMEPATH%\PrintHood\~BhR1fzkQvFV906Tb5YiX.TMP
- %HOMEPATH%\PrintHood\~HPSJLbgkwlqek0FObmTH.TMP
- %HOMEPATH%\PrintHood\~72mPDKHxZqJBQDT1vo5u.TMP
- %HOMEPATH%\PrintHood\~tHuJiN8BFabn7Yrwu4AK.TMP
- %HOMEPATH%\PrintHood\~vlEoeVXnhuotsWBSqyOJ.TMP
- %HOMEPATH%\PrintHood\~G26Jyw3RTliK4KAngiji.TMP
- %HOMEPATH%\PrintHood\~tgctZbJxyrVmuvE8h6Ff.TMP
- %HOMEPATH%\PrintHood\~nHKSe8v9G6jSoLOnZ1UI.TMP
- %HOMEPATH%\PrintHood\~zl4G2smueSxRKK6dgV3w.TMP
- %HOMEPATH%\PrintHood\~VvxBsULEMeVRg1h580C8.TMP
- %HOMEPATH%\PrintHood\~brRMqTkGRai6BEO3ZkTB.TMP
- %HOMEPATH%\PrintHood\~7B7WNtFQz94KtFT70DTZ.TMP
- %HOMEPATH%\PrintHood\~vVHo82XSDz0yw8apLYgm.TMP
- %HOMEPATH%\PrintHood\~ET5EEcBchmSQgfL19TaM.TMP
- %HOMEPATH%\PrintHood\~pd3xZU5VlfO5jTYjogzp.TMP
- %HOMEPATH%\PrintHood\~NVeRXV6Jabd7V5IHxD7p.TMP
- %HOMEPATH%\PrintHood\~R88iDRDoyQw2Mf6PiXQF.TMP
- %HOMEPATH%\PrintHood\~KwA7CThBS4YqXxI84qeU.TMP
- %HOMEPATH%\PrintHood\~o0d7EWU94RmHUpfbEeMR.TMP
- %HOMEPATH%\PrintHood\~CTQa5XFfMBewwP88yhzi.TMP
- %HOMEPATH%\PrintHood\~PNoBcZHAYogCXwDeVtib.TMP
- %HOMEPATH%\PrintHood\~Cio1OwqMKQcI0CTV78Bz.TMP
- %HOMEPATH%\PrintHood\~YIx1dNraTIf1LBRo22kO.TMP
- %HOMEPATH%\PrintHood\~aeCeiyiT6FvRdTKWdhzJ.TMP
- %HOMEPATH%\PrintHood\~OFeLNW0xLr7JC4MMW3bT.TMP
- %HOMEPATH%\PrintHood\~guWUvfHKaruQyi5a4skf.TMP
- %HOMEPATH%\PrintHood\~5AfzvrKNRNh03HEWQpAj.TMP
- %HOMEPATH%\PrintHood\~oZcVjRLdcBtfKEoj45D3.TMP
- %HOMEPATH%\PrintHood\~cky6HERvVIojBo4xlSi9.TMP
- %HOMEPATH%\PrintHood\~V46mvdENWIwh4xRTWgDK.TMP
- %HOMEPATH%\PrintHood\~H8Vxv6vnQ5gKYprl3hBi.TMP
- %HOMEPATH%\PrintHood\~BEKf7anjFcHvucr7EoYN.TMP
- %HOMEPATH%\PrintHood\~IDbLH7rcEMqjTQr8vi1Y.TMP
- %HOMEPATH%\PrintHood\~Rs7c7wrr6gM55oKUcbNe.TMP
- %HOMEPATH%\PrintHood\~miXgf00u5jet0mFl34cH.TMP
- %HOMEPATH%\PrintHood\~an2Xa9twWOw0q0vqGBdK.TMP
- %HOMEPATH%\PrintHood\~BjfoNsIq088xl3wJu9Xt.TMP
- %HOMEPATH%\PrintHood\~AJfpWJW2B8JIYeyQQZ0k.TMP
- %HOMEPATH%\PrintHood\~3xEObJZNvozK94Wnx8jj.TMP
- %HOMEPATH%\PrintHood\~FKn9VNDIXMMhLRBof0PA.TMP
- %HOMEPATH%\PrintHood\~r8l281QuqSf9hRFZVGaM.TMP
- %HOMEPATH%\PrintHood\~rNxEuYXbVpFgdm8bVHFa.TMP
- %HOMEPATH%\PrintHood\~TtkgMoWA9qbn8fchpLfx.TMP
- %HOMEPATH%\PrintHood\~EEEHN3iUWqjYuyaWlOcd.TMP
- %HOMEPATH%\PrintHood\~odVD0WS9tpB1ahU405Zv.TMP
- %HOMEPATH%\PrintHood\~JaW7R7ZOq7rLEwdVFwrq.TMP
Удаляет следующие файлы:
- %HOMEPATH%\PrintHood\pangtip.bat
- %HOMEPATH%\PrintHood\<Имя вируса>.exe.txt
Сетевая активность:
Подключается к:
- 'localhost':1038
- 'localhost':1039
- 'localhost':1037
- 'localhost':1035
- 'localhost':1036
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'http://174.142.57.29/ - 404 - File or directory not found. - Windows Internet Explorer'
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: '404 - File or directory not found. - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'http://174.142.57.29/ - 404 - File or directory not found. - Microsoft Internet Explorer'
- ClassName: '' WindowName: '404 - File or directory not found. - Windows Internet Explorer'
- ClassName: '' WindowName: 'u!u!u!u! - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'http://174.142.57.29/ - u!u!u!u! - Windows Internet Explorer'
- ClassName: '' WindowName: 'u!u!u!u! - Windows Internet Explorer'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'http://174.142.57.29/ - u!u!u!u! - Microsoft Internet Explorer'
