Trojan.MulDrop3.34373

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%HOMEPATH%\UpBackup\UpdateOffice.exe

Вредоносные функции:

Создает и запускает на исполнение:

%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\UpBackup\UpdateOffice.exe

Запускает на исполнение:

<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\pangtip.bat" "
<SYSTEM32>\ping.exe www.ma##kil.in
<SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %HOMEPATH%\My Documents\<Имя вируса>.exe.jpg
<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\100.bat" "

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\PrintHood\~lcEjJgCYuVxQrp9f1xn5.TMP
%HOMEPATH%\PrintHood\~NdDy1lygpUGkhgRleyEz.TMP
%HOMEPATH%\PrintHood\~MRxplWd0n33dBBrCBKCU.TMP
%HOMEPATH%\PrintHood\~Ad3CvvQbymIhlj4xsQSe.TMP
%HOMEPATH%\PrintHood\oXEdTwhyPQ.PRI
%HOMEPATH%\PrintHood\9b3wpPsRsr.PRI
%HOMEPATH%\PrintHood\rdRu3uTaFo.PRI
%HOMEPATH%\PrintHood\FE5s9zMxhz.PRI
%HOMEPATH%\PrintHood\6tcet1Uc6M.PRI
%HOMEPATH%\PrintHood\~bMxrtwZjiwpYlqf7WQiZ.TMP
%HOMEPATH%\PrintHood\~5N4s7Xpqg00vgQoeFqCw.TMP
%HOMEPATH%\PrintHood\~KXnl7Uz69cKASfbvtg7k.TMP
%HOMEPATH%\PrintHood\~nXndZ1I7rxIoaZeBCKaW.TMP
%HOMEPATH%\PrintHood\~o64zqzhrFQFCza8exJ8V.TMP
%HOMEPATH%\PrintHood\~69401JxVhbt73WeI2ZfA.TMP
%HOMEPATH%\PrintHood\~IQCixJrZVKLA5r2txQsX.TMP
%HOMEPATH%\PrintHood\~4oIjlFSINeHOLekSbEy6.TMP
%HOMEPATH%\PrintHood\~nTMBkVPf0JVejrrJJf7p.TMP
%HOMEPATH%\PrintHood\~NHGGUuvFlpzgnYRRpo3U.TMP
%HOMEPATH%\PrintHood\RH0lCsqbNW.PRI
%HOMEPATH%\PrintHood\T9RO6W68Gc.PRI
%HOMEPATH%\PrintHood\OWO3GFzbGF.PRI
%HOMEPATH%\PrintHood\eEwFepKrUU.PRI
%HOMEPATH%\PrintHood\k3vufFVwRU.PRI
%HOMEPATH%\PrintHood\CtXilu3nXJ.PRI
%HOMEPATH%\PrintHood\tZTcMVQph3.PRI
%HOMEPATH%\PrintHood\dpaJwEb6RR.PRI
%HOMEPATH%\PrintHood\go2pOevR8x.PRI
%HOMEPATH%\PrintHood\5hAmMCQNxT.PRI
%HOMEPATH%\PrintHood\xsZpJPJ6mm.PRI
%HOMEPATH%\PrintHood\TBbAtjyVbo.PRI
%HOMEPATH%\PrintHood\VPKVn3vUnc.PRI
%HOMEPATH%\PrintHood\JM81xBio4O.PRI
%HOMEPATH%\PrintHood\AedBMvtQ17.PRI
%HOMEPATH%\PrintHood\RwXFVCJ0Em.PRI
%HOMEPATH%\PrintHood\C2ReJ92uzf.PRI
%HOMEPATH%\PrintHood\SMqIO8IhZs.PRI
%HOMEPATH%\PrintHood\0TgKB6iIuU.PRI
%HOMEPATH%\PrintHood\hMZbsnvJeq.PRI
%HOMEPATH%\PrintHood\~3dOxxmcm8NBSDXB1ISY6.TMP
%HOMEPATH%\PrintHood\~9carBNcRyhfAUmfXXez4.TMP
%HOMEPATH%\PrintHood\~Ud2EnCAanslbPDrvBOhk.TMP
%HOMEPATH%\PrintHood\~iGpzVtdWa4UIOpTTphHN.TMP
%HOMEPATH%\PrintHood\~HmHtkc96Q83uq7dcKQoi.TMP
%HOMEPATH%\PrintHood\~n0km1sdQyom9ecggMB3O.TMP
%HOMEPATH%\PrintHood\~qLF0bYJTWSv5DW4HTRsr.TMP
%HOMEPATH%\PrintHood\~LhHBSwNPxVPTkGPICfpq.TMP
%HOMEPATH%\PrintHood\~r0XK6RhwLPjKBZATssri.TMP
%HOMEPATH%\PrintHood\~fu0DzkPTfAugsd1yj5Eg.TMP
%HOMEPATH%\PrintHood\~LZKYUILowaaBaR5ViERD.TMP
%HOMEPATH%\PrintHood\~tESKQich6y1SVlVWnbb9.TMP
%HOMEPATH%\PrintHood\~jbTsJ1jpif3rkW3qqoWH.TMP
%HOMEPATH%\PrintHood\~pWyNmzzbm6QZFhNq04L1.TMP
%HOMEPATH%\PrintHood\~edJJcaCEj14UrjbE3onT.TMP
%HOMEPATH%\PrintHood\~6woM8vy1u7AfhUNEx5eS.TMP
%HOMEPATH%\PrintHood\~caY2R1Kzd2EKIdZMN5t8.TMP
%HOMEPATH%\PrintHood\~ZJZp9Qr3KuCxTqhLDEGW.TMP
%HOMEPATH%\PrintHood\~5hxhGKgFeVCqxEhtrpEc.TMP
%HOMEPATH%\PrintHood\~NiBoyBQOQyFMOqSriBaI.TMP
%HOMEPATH%\PrintHood\~aSscpI4bsGDUXIyhwkU5.TMP
%HOMEPATH%\PrintHood\~aut7A4zKftHi4U3umIPq.TMP
%HOMEPATH%\PrintHood\~IA8mc8ruuv8WhHRMARvw.TMP
%HOMEPATH%\PrintHood\~oxaqJmei4pbkjvaGS7vb.TMP
%HOMEPATH%\PrintHood\~X331QjzWwIAxwXRZylbq.TMP
%HOMEPATH%\PrintHood\~ZLMhdGxKbtaVtw5gX24H.TMP
%HOMEPATH%\PrintHood\~6ztHN4Gd1v1fn1RNQvKK.TMP
%HOMEPATH%\PrintHood\~uoo54u66yUPrd3hX0sbp.TMP
%HOMEPATH%\PrintHood\~HL1iHvU2UEyunQon11rp.TMP
%HOMEPATH%\PrintHood\~ns5HiPdXj2EyTQb6VXbm.TMP
%HOMEPATH%\PrintHood\~PoZiMvI4CWH2j8JGASMK.TMP
%HOMEPATH%\PrintHood\~ZXnE2CPOfZUMlzNq4Cmu.TMP
%HOMEPATH%\PrintHood\~RUxy9V475eJupTFdVkSn.TMP
%HOMEPATH%\PrintHood\~lL5nDS13nc0lbUEOVkxZ.TMP
%HOMEPATH%\PrintHood\~iOdZyMxJQ0LuJIM3DiV9.TMP
%HOMEPATH%\PrintHood\~NYQGzwRjqsalT4R7NRwQ.TMP
%HOMEPATH%\PrintHood\~eMTiH9vcKFzajCElYSBm.TMP
%HOMEPATH%\PrintHood\~uUT3z2w4eQfgRWLuYhUD.TMP
%HOMEPATH%\PrintHood\~F4sPfbWnWV1U5VQRP3g4.TMP
%HOMEPATH%\PrintHood\~xUTw1KhrkAj5pKTMk1FH.TMP
%HOMEPATH%\PrintHood\2FaucuyA2g.PRI
%HOMEPATH%\PrintHood\32FawyDjKo.dll
%HOMEPATH%\PrintHood\J8dXNmezjz.dll
%HOMEPATH%\PrintHood\IVCeZdOWiT.dll
%HOMEPATH%\PrintHood\2yEkP4sjWj.dll
%HOMEPATH%\PrintHood\ses5sa73aT.dll
%HOMEPATH%\PrintHood\DKw4XIEXHu.dll
%HOMEPATH%\PrintHood\JxdXVWG41l.dll
%HOMEPATH%\PrintHood\ZQNb5wpSZB.dll
%HOMEPATH%\PrintHood\vJ8BVsxVmc.dll
%HOMEPATH%\PrintHood\VKyurW1CrE.dll
%HOMEPATH%\PrintHood\irrKDxU6fL.dll
%HOMEPATH%\PrintHood\69Mpa9vO4J.dll
%HOMEPATH%\PrintHood\EL7SQuXo83.dll
%HOMEPATH%\PrintHood\qiwuaUPYG5.dll
%HOMEPATH%\PrintHood\o5AGq6qfPT.dll
%HOMEPATH%\PrintHood\v1YZ8S5BaL.dll
%HOMEPATH%\PrintHood\C9FK3iYTz4.dll
%HOMEPATH%\PrintHood\IXAe4drXin.dll
%HOMEPATH%\PrintHood\IiXrwmUJZN.dll
%HOMEPATH%\PrintHood\VQFNVTjZCX.dll
%HOMEPATH%\PrintHood\JphZG0I94N.dll
%HOMEPATH%\PrintHood\AsHvZRAf6T.dll
%HOMEPATH%\PrintHood\wmqMxP8DGG.dll
%HOMEPATH%\PrintHood\Mj4CeO6eai.dll
%HOMEPATH%\PrintHood\8IVRFbk8eG.dll
%HOMEPATH%\PrintHood\pangtip.bat
%HOMEPATH%\PrintHood\UPDATE~1.EXE.pkxm
%HOMEPATH%\PrintHood\TcKBEywIJi.dll
%HOMEPATH%\Templates\nam.dll
%HOMEPATH%\PrintHood\9RMGxJkl7g.dll
%HOMEPATH%\PrintHood\4nbGzTBTNn.dll
%HOMEPATH%\PrintHood\W8B2K7lwQY.dll
%HOMEPATH%\PrintHood\633wBXnUp2.dll
%HOMEPATH%\PrintHood\nhMWbjCjzC.dll
%HOMEPATH%\PrintHood\foarZoN6gF.dll
%HOMEPATH%\PrintHood\Mbydo1yUAU.dll
%HOMEPATH%\PrintHood\dG6dwJBO2c.dll
%HOMEPATH%\PrintHood\cSIEVb1UAJ.dll
%HOMEPATH%\PrintHood\cxpLp28x8n.dll
%HOMEPATH%\PrintHood\1YwBIR8JKs.dll
%HOMEPATH%\PrintHood\ngK2EW0ETl.PRI
%HOMEPATH%\PrintHood\CdpGwJITua.PRI
%HOMEPATH%\PrintHood\cJ5UqoUkKH.PRI
%HOMEPATH%\PrintHood\YUY9KQKgLU.PRI
%HOMEPATH%\PrintHood\icx5FUe2VN.PRI
%HOMEPATH%\PrintHood\J8MlzAaFhF.PRI
%HOMEPATH%\PrintHood\4QDwKXD67x.PRI
%HOMEPATH%\PrintHood\lBZymlWFap.PRI
%HOMEPATH%\PrintHood\Grp2luTbZ3.PRI
%HOMEPATH%\PrintHood\CaRhGVNxa2.PRI
%HOMEPATH%\PrintHood\YLAwqbGm7w.PRI
%HOMEPATH%\PrintHood\Yp4zR2V8Fi.PRI
%HOMEPATH%\PrintHood\CNMqVgIEkG.PRI
%HOMEPATH%\PrintHood\ULRr1OB0h9.PRI
%HOMEPATH%\PrintHood\LMNwgVEvBL.PRI
%HOMEPATH%\PrintHood\5Fe2IHEYmT.PRI
%HOMEPATH%\PrintHood\xNBja4KgLb.PRI
%HOMEPATH%\PrintHood\jUwEMIdWd2.PRI
%HOMEPATH%\PrintHood\tiAOO9QOGp.PRI
%HOMEPATH%\PrintHood\7hwGalIbkh.PRI
%HOMEPATH%\PrintHood\nlvhone8ll.dll
%HOMEPATH%\PrintHood\Yl1xsZ8XWI.dll
%HOMEPATH%\PrintHood\lNm42ycEyy.dll
%HOMEPATH%\PrintHood\MUT4DxHtjm.dll
%HOMEPATH%\PrintHood\kzdYWDsVAf.dll
%HOMEPATH%\PrintHood\xzFUzbjmit.dll
%HOMEPATH%\PrintHood\nby90VNBTi.dll
%HOMEPATH%\PrintHood\ZtSdptmoyh.dll
%HOMEPATH%\PrintHood\eMbIEpDSyo.dll
%HOMEPATH%\PrintHood\G7regkWGEp.dll
%HOMEPATH%\PrintHood\IqbKnZ8sFE.PRI
%HOMEPATH%\PrintHood\VDJ7x8HGo4.PRI
%HOMEPATH%\PrintHood\srvHMO6eqU.PRI
%HOMEPATH%\PrintHood\68ebhFGrSz.PRI
%HOMEPATH%\PrintHood\493INaTJ8p.PRI
%HOMEPATH%\PrintHood\QObNMhHVkC.dll
%HOMEPATH%\PrintHood\aYhNd05vTR.dll
%HOMEPATH%\PrintHood\fGsIJrirtk.dll
%HOMEPATH%\PrintHood\5lbIrYtYvn.dll
%HOMEPATH%\PrintHood\~i6sUE3oWOoI62V8hOsUB.TMP
%HOMEPATH%\PrintHood\~IK3P4m3QSYXApdr05kaT.TMP
%HOMEPATH%\PrintHood\~ylEXzTXsDx46trsP1cUQ.TMP
%HOMEPATH%\PrintHood\~NWLXJ31zLNB2876AS30T.TMP
%HOMEPATH%\PrintHood\~uy7gICmoaEDRIuNmgEHw.TMP
%HOMEPATH%\PrintHood\~n2sPjNmxaybq25wmMZiX.TMP
%HOMEPATH%\PrintHood\~c3XAHjCHhLe9k2AWlKnY.TMP
%HOMEPATH%\PrintHood\~3pkwdiy5Qj9roqNahcQB.TMP
%HOMEPATH%\PrintHood\~RK60BYDHZTnqYHU4U6TQ.TMP
%HOMEPATH%\PrintHood\~8zkE1yhQ9Jx9UQltep47.TMP
%HOMEPATH%\PrintHood\~FxTDI5Dq1SUFXla7uLZ8.TMP
%HOMEPATH%\PrintHood\~0F9roQLuQurn3QLG7WRC.TMP
%HOMEPATH%\PrintHood\~yHkPQRLlxDM4CQVkYl3T.TMP
%HOMEPATH%\PrintHood\~5GUMlJXXjPhZUakr0lNA.TMP
%HOMEPATH%\PrintHood\~HGTN70ZpOv1KVw4UDdCS.TMP
%HOMEPATH%\PrintHood\~UoUwuzW3QnWCeaQYbMVA.TMP
%HOMEPATH%\PrintHood\~tQr8CM6MBksZ8AWUbsjV.TMP
%HOMEPATH%\PrintHood\~IdCb5U96nGDdXsYSFGv6.TMP
%HOMEPATH%\PrintHood\~tCxInfBBEkM3uhicKObh.TMP
%HOMEPATH%\PrintHood\~uAuaZpfXPiGZ9eddLLdU.TMP
%HOMEPATH%\PrintHood\~odIe6qrZoxdRuXNiBEg6.TMP
%HOMEPATH%\PrintHood\~ZPIqdaF2XJtpgAoqpULU.TMP
%HOMEPATH%\PrintHood\~qf2UzRMWsjLUvBnxfzXK.TMP
%HOMEPATH%\PrintHood\~tRUYLCehfzYypOb1N9xT.TMP
%HOMEPATH%\PrintHood\~XABLzDTyFKhJtUmyf3v2.TMP
%HOMEPATH%\PrintHood\~zbpk0YnU9pOKv8CKLX2M.TMP
%HOMEPATH%\PrintHood\~HvfTtIx2tJ3OE12zA5fh.TMP
%HOMEPATH%\PrintHood\~mekq3ngCbQDyiq1gL75A.TMP
%HOMEPATH%\PrintHood\~0CL8Re3DBoLQ2fFQg2yB.TMP
%HOMEPATH%\PrintHood\~XVAivEncw1XFzA57cLDW.TMP
%HOMEPATH%\PrintHood\~OhGWNZCGgEFOPTow7g7Y.TMP
%HOMEPATH%\PrintHood\~z380BujvZg3nXOR6ISer.TMP
%HOMEPATH%\PrintHood\~8ozXx7JViLDLPlxr32He.TMP
%HOMEPATH%\PrintHood\~zMJJgWFplOesXLnNuW0h.TMP
%HOMEPATH%\PrintHood\~48a7pr3cdsley14lMFon.TMP
%HOMEPATH%\PrintHood\~GmNpzvxbd58leChg8DVN.TMP
%HOMEPATH%\PrintHood\~eW9mMMxJacsqbsdDTUZh.TMP
%HOMEPATH%\PrintHood\~6zOvcboat2YFrrsp37G6.TMP
%HOMEPATH%\PrintHood\~tzrc9zfLf0xZwpEmLc0D.TMP
%HOMEPATH%\PrintHood\~7Omk0SJxo627J9fGzsG8.TMP
%HOMEPATH%\PrintHood\~cv7MUzlHiEls0uhkzhue.TMP
%HOMEPATH%\PrintHood\~3pjpRkAVc0qmrS7zAPeR.TMP
%HOMEPATH%\Recent\<Имя вируса>.exe.lnk
%HOMEPATH%\PrintHood\xdat.dll
%HOMEPATH%\PrintHood\~lgtvaG57EgQBSV3zlSmm.TMP
%HOMEPATH%\PrintHood\~ae6v9SY44YWMBVehvNeL.TMP
%HOMEPATH%\PrintHood\~EjPybyJuovwE8qZcihjM.TMP
%HOMEPATH%\PrintHood\~zmGHL8yihBTPmqgNMTeJ.TMP
%HOMEPATH%\PrintHood\~Xa436q7Ncu4wE8sdOQnt.TMP
%HOMEPATH%\PrintHood\100.bat
%HOMEPATH%\PrintHood\BIE.dll
%HOMEPATH%\PrintHood\FIE.dll
%HOMEPATH%\PrintHood\SHK.dll
%HOMEPATH%\PrintHood\SIK.dll
%HOMEPATH%\PrintHood\Roze.dll
%HOMEPATH%\My Documents\<Имя вируса>.exe.jpg
%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\PrintHood\mahdi.txt
%HOMEPATH%\My Documents\<Имя вируса>.exe.txt
%HOMEPATH%\PrintHood\~MkoDXrBkMqO0NeuvWWTG.TMP
%HOMEPATH%\PrintHood\~HDqIRZizRY2SX70MDzRX.TMP
%HOMEPATH%\PrintHood\~ZH6UF8LtAcqjN0PzDwDl.TMP
%HOMEPATH%\PrintHood\~ePGMkHCal10CYkZ8d4wc.TMP
%HOMEPATH%\PrintHood\~aVUozSFMFT2jKJR51e2L.TMP
%HOMEPATH%\PrintHood\~2rhuXl1br6pyrHzpq6LM.TMP
%HOMEPATH%\PrintHood\~Pwv0xdRQ3PzMFP2R0cTA.TMP
%HOMEPATH%\PrintHood\~LyqtUhIIivqlupGQd2lX.TMP
%HOMEPATH%\PrintHood\~RJdOcCDl9zNVInpTSy6p.TMP
%HOMEPATH%\PrintHood\~rLyCBBelWZgoVtDgMJIP.TMP
%HOMEPATH%\PrintHood\~M85wsNWbZ5jyAgv5c8We.TMP
%HOMEPATH%\PrintHood\~rVZDtACW6nsZofCZfrnN.TMP
%HOMEPATH%\PrintHood\~ov0K4pVOe5GnXZcda6TR.TMP
%HOMEPATH%\PrintHood\~5J4Ppv0As2wS3HL9DUpc.TMP
%HOMEPATH%\PrintHood\~aB8JuJ9x2SSc3MTHtPB7.TMP
%HOMEPATH%\PrintHood\~tKfmE6SuXPfqWRswZhHy.TMP
%HOMEPATH%\PrintHood\~KnbFZgJrAGcImSunQVl9.TMP
%HOMEPATH%\PrintHood\~QhqZ7ho6EDGjUHCYSEIc.TMP
%HOMEPATH%\PrintHood\~7hZOT6YtUAbRhRpkuSvf.TMP
%HOMEPATH%\PrintHood\~kQ6A57kuuIy0ZRNr5pF8.TMP
%HOMEPATH%\PrintHood\~ToYAJIJXsxSBJopVnJuw.TMP
%HOMEPATH%\PrintHood\~2o5zTDlteebnrlOqsnTB.TMP
%HOMEPATH%\PrintHood\~gN62WwOUIxq0a92vgKrt.TMP
%HOMEPATH%\PrintHood\~kgRrsGaVgDkpRQGqUh8G.TMP
%HOMEPATH%\PrintHood\~2OriZ9mTzBG0TMQFMXwV.TMP
%HOMEPATH%\PrintHood\~zv1kCwj4ijpasSv1ougv.TMP
%HOMEPATH%\PrintHood\~mFEuuvVBRLVLIH2qtgwu.TMP
%HOMEPATH%\PrintHood\~ttq3hzFw7xOoWZeiVWTh.TMP
%HOMEPATH%\PrintHood\~IwYQVBhRBMqeNVGK0p5S.TMP
%HOMEPATH%\PrintHood\~nwbRKiEgEw7RzjIg0ZER.TMP
%HOMEPATH%\PrintHood\~yOyP40hfbU3kwyNncsa1.TMP
%HOMEPATH%\PrintHood\~2aBx8ua065DIHDmjKnQy.TMP
%HOMEPATH%\PrintHood\~cueHzQMnlwMFU5yJzTfY.TMP
%HOMEPATH%\PrintHood\~1HCyvXevV6P3mpvbqc47.TMP
%HOMEPATH%\PrintHood\~4XJ92R7TTMSZjinKSO0P.TMP
%HOMEPATH%\PrintHood\~RrkftFVUjeis2GFnsFiA.TMP
%HOMEPATH%\PrintHood\~55r1sExUfItj0sMnpbFl.TMP
%HOMEPATH%\PrintHood\~tfuLyxCpoO5VxN5jBIdK.TMP
%HOMEPATH%\PrintHood\~DrO6VT2GW6Ay7h7qr7z7.TMP
%HOMEPATH%\PrintHood\~7WaQmmwFZ9LUegzuylTd.TMP
%HOMEPATH%\PrintHood\~Zulg7h58m0cZgIMvJRpx.TMP
%HOMEPATH%\PrintHood\~heEyTOTC5CPWo4JmhSIs.TMP
%HOMEPATH%\PrintHood\~gfvX2DRo3V0TOUnpHWKL.TMP
%HOMEPATH%\PrintHood\~UamRxp4HzZX4OzEhph3E.TMP
%HOMEPATH%\PrintHood\~UINKUCk4CPhgdhHdj4CD.TMP
%HOMEPATH%\PrintHood\~OoF9Lj6o7wm3OwCER1NC.TMP
%HOMEPATH%\PrintHood\~mVgQU6gcB5gjoOKhIaQ7.TMP
%HOMEPATH%\PrintHood\~pdnBGE9jA92MoCfo3FbR.TMP
%HOMEPATH%\PrintHood\~MzRPzpLTB4iEFgkU77TR.TMP
%HOMEPATH%\PrintHood\~1lD3ti0KkVLGQbCLM1B1.TMP
%HOMEPATH%\PrintHood\~zqhKSslmN8aSlKMXuwLi.TMP
%HOMEPATH%\PrintHood\~Phh09xz56XWXQ3fGx1kb.TMP
%HOMEPATH%\PrintHood\~p7AcauvcyubovAAyFBT1.TMP
%HOMEPATH%\PrintHood\~NVHyaTDQWzXlh2zdNrRN.TMP
%HOMEPATH%\PrintHood\~jv2wEKFovZL3bgAYH7Iz.TMP
%HOMEPATH%\PrintHood\~k1HUPZv4KVC7wIGMuNJh.TMP
%HOMEPATH%\PrintHood\~fPsLjxxOIU1bSdEZ5OcJ.TMP
%HOMEPATH%\PrintHood\~QZY5yLX3UPMl7z2J10Q0.TMP
%HOMEPATH%\PrintHood\~d2NjT2G9Rr8n4Qcmz006.TMP
%HOMEPATH%\PrintHood\~xuAFt9g5eiQGJZ20uYHY.TMP
%HOMEPATH%\PrintHood\~6SM5GuPNR8y1XyzGCFDH.TMP
%HOMEPATH%\PrintHood\~w4csp2TwcjF1BZzkNNSb.TMP
%HOMEPATH%\PrintHood\~hpBTv8ZSa6zS3E5XZMmp.TMP
%HOMEPATH%\PrintHood\~v4uowxWLmqSgNXuFRyji.TMP
%HOMEPATH%\PrintHood\~uilOcoduQsUmgm92GatE.TMP
%HOMEPATH%\PrintHood\~bXO00MujMbhxlhYueLcC.TMP
%HOMEPATH%\PrintHood\~CHOheA39lcxRSdxHx25U.TMP
%HOMEPATH%\PrintHood\~xQ6bQ7CasFZ16ltf96ry.TMP
%HOMEPATH%\PrintHood\~hfwWHGg41CtI0BwjoE66.TMP
%HOMEPATH%\PrintHood\~4yHMZCMouIRJvSn85PCs.TMP
%HOMEPATH%\PrintHood\~7uUMLWyXZ0yADBY0bYJC.TMP
%HOMEPATH%\PrintHood\~bBmwPQTxCxg6fzoqGQbA.TMP
%HOMEPATH%\PrintHood\~GIaVnozv4EcnMNcSkZM1.TMP
%HOMEPATH%\PrintHood\~yyNslDB2MRMTQxaqvZuZ.TMP
%HOMEPATH%\PrintHood\~GnUOpjEtIP3WLQOJwEue.TMP
%HOMEPATH%\PrintHood\~IPbRdkcDhTpW5zu1v0vN.TMP
%HOMEPATH%\PrintHood\~xI3YGlcxGCnwSpfqu9xN.TMP
%HOMEPATH%\PrintHood\~R8DDjGfN8VR9pBGqjT6D.TMP
%HOMEPATH%\PrintHood\~N1YIYCkYknxpqxUIp2LM.TMP
%HOMEPATH%\PrintHood\~jzUbyvHPCJ1oVSgtYcU7.TMP
%HOMEPATH%\PrintHood\~AaBG5WOCGZ5wku0jHeYm.TMP
%HOMEPATH%\PrintHood\~sPT9C3YmPDKWRwh24PNH.TMP
%HOMEPATH%\PrintHood\~spZYQQboZggWWLgbJe8U.TMP
%HOMEPATH%\PrintHood\~QV6tUnhWnUlQEH5WC986.TMP
%HOMEPATH%\PrintHood\~AmDroksD9PpjgmwifYBb.TMP
%HOMEPATH%\PrintHood\~Kmt0bCylxxdwWlI0pjh7.TMP
%HOMEPATH%\PrintHood\~XwfhonamBiv7527j8IA2.TMP
%HOMEPATH%\PrintHood\~1987KtlkeaeM4EqmpC5V.TMP
%HOMEPATH%\PrintHood\~I0PQGklm4UTJLRlvXIsq.TMP
%HOMEPATH%\PrintHood\~ce0Ukehbx1fOqCXabneV.TMP
%HOMEPATH%\PrintHood\~ERUCkBkEhroETbGZSejm.TMP
%HOMEPATH%\PrintHood\~iITaHo89S3ChzYLpb3H0.TMP
%HOMEPATH%\PrintHood\~0JwJWT30NVQCuwVlYUdn.TMP
%HOMEPATH%\PrintHood\~GyDgtmbXXWNH00JKNnSI.TMP
%HOMEPATH%\PrintHood\~w93IfnPbJTdTmgyyu8uE.TMP
%HOMEPATH%\PrintHood\~3nYsoAUiRNxFBThkHHtt.TMP
%HOMEPATH%\PrintHood\~qJ1ufvLNHP2ERS04ZhrD.TMP
%HOMEPATH%\PrintHood\~Q5RZU1lbXC5p6w8ebadC.TMP
%HOMEPATH%\PrintHood\~cP27tR4MKUUVffjBDDdb.TMP
%HOMEPATH%\PrintHood\~zlv5s8yTkMnUlhqnWnO6.TMP

Удаляет следующие файлы:

%HOMEPATH%\My Documents\<Имя вируса>.exe.txt

Сетевая активность:

UDP:

DNS ASK www.ma##kil.in

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней