Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %HOMEPATH%\UpBackup\Officedesktop.exe
Вредоносные функции:
Создает и запускает на исполнение:
- %HOMEPATH%\PrintHood\Officedesktop.exe
- %HOMEPATH%\UpBackup\Officedesktop.exe
Запускает на исполнение:
- <SYSTEM32>\ping.exe www.ma##kil.in
- <SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\pangtip.bat" "
- <SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\100.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\PrintHood\~z2lf2MQeAB85CQTqkjle.TMP
- %HOMEPATH%\PrintHood\hQs8OiruV0.PRI
- %HOMEPATH%\PrintHood\~3W60Gr5ShiXqgwWdUndK.TMP
- %HOMEPATH%\PrintHood\~FUpzTL6jmqKzsbG769LA.TMP
- %HOMEPATH%\PrintHood\iRdkKClCNk.PRI
- %HOMEPATH%\PrintHood\htUgKYFY2S.PRI
- %HOMEPATH%\PrintHood\X6LF37PDcx.PRI
- %HOMEPATH%\PrintHood\zESMQR8MUr.PRI
- %HOMEPATH%\PrintHood\byihJ4bL8l.PRI
- %HOMEPATH%\PrintHood\~xZmWAZDuQtCvQky57sxU.TMP
- %HOMEPATH%\PrintHood\~Kfrdo2wihBG2DUZyrD6c.TMP
- %HOMEPATH%\PrintHood\~VzUPaZn16kT9lc7sZSuZ.TMP
- %HOMEPATH%\PrintHood\~dPGOznlAfP4VYYcFqU3n.TMP
- %HOMEPATH%\PrintHood\~leOjj0JmrtGZIG3SYSLA.TMP
- %HOMEPATH%\PrintHood\~n9R8X4iaCIHksk9SJoNJ.TMP
- %HOMEPATH%\PrintHood\~zcRfKDhkDsiNX0UtdhEi.TMP
- %HOMEPATH%\PrintHood\~E59lZAK5HSV9uQVVRqDA.TMP
- %HOMEPATH%\PrintHood\~pTHNXEMT3trdbQpmSqch.TMP
- %HOMEPATH%\PrintHood\~hCwWZsGLFm3NmoX2MiCc.TMP
- %HOMEPATH%\PrintHood\8Q2RwBQlIC.PRI
- %HOMEPATH%\PrintHood\yodtyN89vI.PRI
- %HOMEPATH%\PrintHood\NvJFxNmpbh.PRI
- %HOMEPATH%\PrintHood\stRHTGHrbZ.PRI
- %HOMEPATH%\PrintHood\dmAOOGYqCT.PRI
- %HOMEPATH%\PrintHood\Xp5P4YiPjS.PRI
- %HOMEPATH%\PrintHood\oX6vZF7r7I.PRI
- %HOMEPATH%\PrintHood\KrBsCGBzPc.PRI
- %HOMEPATH%\PrintHood\V6sIF0CGjF.PRI
- %HOMEPATH%\PrintHood\dtLKJr66CM.PRI
- %HOMEPATH%\PrintHood\7aKJALzGvK.PRI
- %HOMEPATH%\PrintHood\K3rGOjsS36.PRI
- %HOMEPATH%\PrintHood\13HDWmRIsJ.PRI
- %HOMEPATH%\PrintHood\aNcip1Mu9D.PRI
- %HOMEPATH%\PrintHood\ZGa9HFHfOS.PRI
- %HOMEPATH%\PrintHood\j4v080Qs35.PRI
- %HOMEPATH%\PrintHood\eyhCMIWMJC.PRI
- %HOMEPATH%\PrintHood\W7RmbKJzxY.PRI
- %HOMEPATH%\PrintHood\7nOPgAse30.PRI
- %HOMEPATH%\PrintHood\1IdnOue1cT.PRI
- %HOMEPATH%\PrintHood\~TVvfbLZo8BgN4O7z2jyo.TMP
- %HOMEPATH%\PrintHood\~mG5uKzeV9c7ALPBvT38X.TMP
- %HOMEPATH%\PrintHood\~FVJ5mGQn9iJzKf7G66Vq.TMP
- %HOMEPATH%\PrintHood\~R3Tvo4haeKHLKqbgCbfs.TMP
- %HOMEPATH%\PrintHood\~YNeV2igFBiMAoE2QW2yB.TMP
- %HOMEPATH%\PrintHood\~gWjroQ6W63Y1D71oL8D0.TMP
- %HOMEPATH%\PrintHood\~qO4kWm8H5d7J5NyFVupA.TMP
- %HOMEPATH%\PrintHood\~8faKOvmvEaWU6z0SK74l.TMP
- %HOMEPATH%\PrintHood\~z4Y9X0vuQH5KCuvfEv8x.TMP
- %HOMEPATH%\PrintHood\~Ms07t2xr9WW68rX3amN2.TMP
- %HOMEPATH%\PrintHood\~LF8DPrnrRXRgRBBPre1d.TMP
- %HOMEPATH%\PrintHood\~DwNxRhO0L8APx0sYg5Vv.TMP
- %HOMEPATH%\PrintHood\~kYhWG6OnUNIkIQHdntwq.TMP
- %HOMEPATH%\PrintHood\~xDl1LzTVm5M31GV7Qci3.TMP
- %HOMEPATH%\PrintHood\~M0B7MCvlB4kDpv9IDRrf.TMP
- %HOMEPATH%\PrintHood\~fQNOuCsFe8jtS5iiNtUv.TMP
- %HOMEPATH%\PrintHood\~9DVshsMKdyh5og4FaJ4b.TMP
- %HOMEPATH%\PrintHood\~RNrY63zGxKcLHPgcoXpy.TMP
- %HOMEPATH%\PrintHood\~UjHIYLb45NidM2eqFApO.TMP
- %HOMEPATH%\PrintHood\~HzhzgTzv7BzI4Yj5OQBH.TMP
- %HOMEPATH%\PrintHood\~2in3I0pf31xxER1kPnPM.TMP
- %HOMEPATH%\PrintHood\~tvfq0ahj2p1qqWDzdLWK.TMP
- %HOMEPATH%\PrintHood\~MUYgl9dOh9c4draJ1OSv.TMP
- %HOMEPATH%\PrintHood\~02q11pwGGUKiCEDlxzVm.TMP
- %HOMEPATH%\PrintHood\~yZWIyJKfkvje6xUhcDzb.TMP
- %HOMEPATH%\PrintHood\~0dYIJjD4TqBos4L3o2Tt.TMP
- %HOMEPATH%\PrintHood\~HSP7o3lDlR51FOzsQBfz.TMP
- %HOMEPATH%\PrintHood\~NEleTvMDYnFhqF3x47T7.TMP
- %HOMEPATH%\PrintHood\~QMiJPN6sEaump7HB7Mpf.TMP
- %HOMEPATH%\PrintHood\~vClEghlRPdUlkDdkpT7U.TMP
- %HOMEPATH%\PrintHood\~jq7zHkBq0i6DPpk3yTTP.TMP
- %HOMEPATH%\PrintHood\~VOfVEiAbEVMOyfNqChNu.TMP
- %HOMEPATH%\PrintHood\~R5FSfDd7sS9L7ybx7qVq.TMP
- %HOMEPATH%\PrintHood\~ibqnelaWBpIbhUOY7ts9.TMP
- %HOMEPATH%\PrintHood\~irMoFrmGKNCxj4UyFX6C.TMP
- %HOMEPATH%\PrintHood\~simzQeNBTzSARhT1PKVQ.TMP
- %HOMEPATH%\PrintHood\~0S0ddZQvCFp7hoZE9Opi.TMP
- %HOMEPATH%\PrintHood\~HphL6PYyN1V5uWgpb2vx.TMP
- %HOMEPATH%\PrintHood\~YgDj313UykkaDXKdMCdW.TMP
- %HOMEPATH%\PrintHood\~zRXtLwszy1IktvxGqPgz.TMP
- %HOMEPATH%\PrintHood\fPSmggdBwQ.dll
- %HOMEPATH%\PrintHood\lgl7523UeZ.dll
- %HOMEPATH%\PrintHood\afgFTJHhBq.dll
- %HOMEPATH%\PrintHood\M02W71ggHV.dll
- %HOMEPATH%\PrintHood\XG3uVk8oCD.dll
- %HOMEPATH%\PrintHood\QySfCVD9XR.dll
- %HOMEPATH%\PrintHood\qcBo3eymD9.dll
- %HOMEPATH%\PrintHood\V0oCZsy985.dll
- %HOMEPATH%\PrintHood\HumSeOQLRS.dll
- %HOMEPATH%\PrintHood\vL4w1Qb8bQ.dll
- %HOMEPATH%\PrintHood\59nvKzsLyv.dll
- %HOMEPATH%\PrintHood\bgM0K3WV8n.dll
- %HOMEPATH%\PrintHood\GPqImqQkeg.dll
- %HOMEPATH%\PrintHood\qzAjOkclfX.dll
- %HOMEPATH%\PrintHood\OYnvYNCvuH.dll
- %HOMEPATH%\PrintHood\9kcGZR5UaC.dll
- %HOMEPATH%\PrintHood\gfHvFrI9Ji.dll
- %HOMEPATH%\PrintHood\kDPqytS3V2.dll
- %HOMEPATH%\PrintHood\r2b38iCIB8.dll
- %HOMEPATH%\PrintHood\JrIOG1zpz6.dll
- %HOMEPATH%\PrintHood\7f15kVlp44.dll
- %HOMEPATH%\PrintHood\uhlDC6V8qC.dll
- %HOMEPATH%\PrintHood\QPIuWH8v6L.dll
- %HOMEPATH%\PrintHood\ZVoxQLwaDh.dll
- %HOMEPATH%\PrintHood\pKFiIVuyul.dll
- %HOMEPATH%\PrintHood\pangtip.bat
- %HOMEPATH%\PrintHood\OFFICE~1.EXE.pkxm
- %HOMEPATH%\PrintHood\loduoI9AlB.dll
- %HOMEPATH%\Templates\nam.dll
- %HOMEPATH%\PrintHood\iGGNcMbuEH.dll
- %HOMEPATH%\PrintHood\Lbesc3UjRa.dll
- %HOMEPATH%\PrintHood\EZ61KHKYit.dll
- %HOMEPATH%\PrintHood\5AuCuwaeYT.dll
- %HOMEPATH%\PrintHood\LqxonS9MNz.dll
- %HOMEPATH%\PrintHood\8lCePipVyy.dll
- %HOMEPATH%\PrintHood\els2Svi8XP.dll
- %HOMEPATH%\PrintHood\2dpqwv4mgA.dll
- %HOMEPATH%\PrintHood\r5Dm2j6izb.dll
- %HOMEPATH%\PrintHood\wR1tZZ3l0h.dll
- %HOMEPATH%\PrintHood\RUzZfSKP0a.dll
- %HOMEPATH%\PrintHood\Ntz1v6aOPT.PRI
- %HOMEPATH%\PrintHood\4tt97Gaiue.PRI
- %HOMEPATH%\PrintHood\b9stSqgoTu.PRI
- %HOMEPATH%\PrintHood\9KqKDyEnhC.PRI
- %HOMEPATH%\PrintHood\d5mgkIa7WA.PRI
- %HOMEPATH%\PrintHood\Jtn8nnn8jh.PRI
- %HOMEPATH%\PrintHood\irrr246ae9.PRI
- %HOMEPATH%\PrintHood\g707AiLeO6.PRI
- %HOMEPATH%\PrintHood\qdiY1fovtv.PRI
- %HOMEPATH%\PrintHood\EvRAizrzqH.PRI
- %HOMEPATH%\PrintHood\1dbmOGgtNO.PRI
- %HOMEPATH%\PrintHood\4zgVVtBNRY.PRI
- %HOMEPATH%\PrintHood\UV5Q4eepbw.PRI
- %HOMEPATH%\PrintHood\6IRRxBv1oG.PRI
- %HOMEPATH%\PrintHood\1MFiqezJDv.PRI
- %HOMEPATH%\PrintHood\UiZ16vmJ5l.PRI
- %HOMEPATH%\PrintHood\hHB5vHuOHr.PRI
- %HOMEPATH%\PrintHood\a09eY9AT17.PRI
- %HOMEPATH%\PrintHood\tZznX2ixrh.PRI
- %HOMEPATH%\PrintHood\Sbcdz2J1lr.PRI
- %HOMEPATH%\PrintHood\igOn226dv2.dll
- %HOMEPATH%\PrintHood\frpsf6zcIg.dll
- %HOMEPATH%\PrintHood\BYirWIaZFz.dll
- %HOMEPATH%\PrintHood\ShyoTcTNXl.dll
- %HOMEPATH%\PrintHood\PLBeWwWHfd.dll
- %HOMEPATH%\PrintHood\DCF1tq8jFK.dll
- %HOMEPATH%\PrintHood\2ZRvwai0in.dll
- %HOMEPATH%\PrintHood\lFk6fLbIqs.dll
- %HOMEPATH%\PrintHood\yelrArVhZ0.dll
- %HOMEPATH%\PrintHood\QuIXYZORnT.dll
- %HOMEPATH%\PrintHood\0CDitbM8bb.PRI
- %HOMEPATH%\PrintHood\GhKhamcvv8.PRI
- %HOMEPATH%\PrintHood\a1i8kmT2yO.PRI
- %HOMEPATH%\PrintHood\doLj2qVELL.PRI
- %HOMEPATH%\PrintHood\GtMU3c2eGe.PRI
- %HOMEPATH%\PrintHood\35F6f1t9ch.dll
- %HOMEPATH%\PrintHood\ojgY5rBEaX.dll
- %HOMEPATH%\PrintHood\BjPQAGjURF.dll
- %HOMEPATH%\PrintHood\poOkAdhDId.dll
- %HOMEPATH%\PrintHood\~VRC2qLyckh8tzMnvFieq.TMP
- %HOMEPATH%\PrintHood\~bI6blQcasY0KPoULipIV.TMP
- %HOMEPATH%\PrintHood\~pPfkL8a56sawsFT3S6qE.TMP
- %HOMEPATH%\PrintHood\~o4TaDi9k7y7uAeTEGMuA.TMP
- %HOMEPATH%\PrintHood\~yxIViP6hnn0stKPYW6Gr.TMP
- %HOMEPATH%\PrintHood\~HD8nGWVOZVLsBzPtKMdY.TMP
- %HOMEPATH%\PrintHood\~eygBnMbQK1dg556eHSih.TMP
- %HOMEPATH%\PrintHood\~9f1In7H57gd0SSDk6sYw.TMP
- %HOMEPATH%\PrintHood\~SB2mvYCEqNgmBPFfgmm8.TMP
- %HOMEPATH%\PrintHood\~BxS2GI7kRaGv3AxUXUb5.TMP
- %HOMEPATH%\PrintHood\~kqBFmdGTebnnhdNw5K9c.TMP
- %HOMEPATH%\PrintHood\~WGEqfqa9foYb7jIFwoRW.TMP
- %HOMEPATH%\PrintHood\~OlUXC9UXZHvn9ADVsRpf.TMP
- %HOMEPATH%\PrintHood\~m35n98ukeP06eISXnyn4.TMP
- %HOMEPATH%\PrintHood\~pZVaX29t7CObODTHI9Uf.TMP
- %HOMEPATH%\PrintHood\~U6i1gbIv0bwhWanL7b8Q.TMP
- %HOMEPATH%\PrintHood\~GKJsx30hIpWxjZhqeWru.TMP
- %HOMEPATH%\PrintHood\~AttuIWIK0vqGIKMykmo5.TMP
- %HOMEPATH%\PrintHood\~vDh0peo2yBNj5kMTobzm.TMP
- %HOMEPATH%\PrintHood\~jphXkBKOJqyrJvmUwjyY.TMP
- %HOMEPATH%\PrintHood\~ukG73hY6SDkk8LjBjijZ.TMP
- %HOMEPATH%\PrintHood\~AFSctc6xy0nkJgMs8XWH.TMP
- %HOMEPATH%\PrintHood\~3sObLe4RpB5ge52TL8yM.TMP
- %HOMEPATH%\PrintHood\~UUuAMKOSS2swROiMpmjC.TMP
- %HOMEPATH%\PrintHood\~snIWWvOiU9ycrEDb8few.TMP
- %HOMEPATH%\PrintHood\~YKDZ8ZOcv3Bf4Zgf9LiQ.TMP
- %HOMEPATH%\PrintHood\~uqed8JE4KHrsACU12XuK.TMP
- %HOMEPATH%\PrintHood\~8yE18hFvmMobLVeAU9Wk.TMP
- %HOMEPATH%\PrintHood\~B2jdB7iVMPYdug0dFOwB.TMP
- %HOMEPATH%\PrintHood\~RIrcEwdFC3ov4APQPNfw.TMP
- %HOMEPATH%\PrintHood\~GuUTM80R3MtF3qls4UPB.TMP
- %HOMEPATH%\PrintHood\~TsYXfs1DGvb0yxzdAv8Y.TMP
- %HOMEPATH%\PrintHood\~WSkYblG5NWa3Yt9dq4Lq.TMP
- %HOMEPATH%\PrintHood\~fWevNSgfDNK8iXaT54zA.TMP
- %HOMEPATH%\PrintHood\~ou18CVHxLTFizcLrKyvO.TMP
- %HOMEPATH%\PrintHood\~axmWuIvJBo8KxKtum33q.TMP
- %HOMEPATH%\PrintHood\~pGnCWqBClqUyHM1zuHum.TMP
- %HOMEPATH%\PrintHood\~zIMdTdF5pfH6RFGiboMN.TMP
- %HOMEPATH%\PrintHood\~wt2UlQP43F50m0ClJitS.TMP
- %HOMEPATH%\PrintHood\~lZKCeJF63oIpiMgylskC.TMP
- %HOMEPATH%\PrintHood\~w3c9Pi5m7MzM0bga731y.TMP
- %HOMEPATH%\PrintHood\~pCENdHwF5k74DwqI95Ll.TMP
- %HOMEPATH%\PrintHood\~lO5UxYvJ5Qo7iKRiXSfe.TMP
- %HOMEPATH%\PrintHood\xdat.dll
- %HOMEPATH%\PrintHood\~vZzGQPvQhvxuL2irEN7I.TMP
- %HOMEPATH%\PrintHood\~fPHcu89MecYpyCu5qrJk.TMP
- %HOMEPATH%\PrintHood\~msDyVFl1u462ZKIq02Yq.TMP
- %HOMEPATH%\PrintHood\~hMB5MkLfrvrJD6YLQFyp.TMP
- %HOMEPATH%\PrintHood\~lOYQ7uOhsz8MpMVWA6Z8.TMP
- %HOMEPATH%\PrintHood\~P81nUFbz3jwbw2BHXnsM.TMP
- %HOMEPATH%\PrintHood\100.bat
- %HOMEPATH%\PrintHood\BIE.dll
- %HOMEPATH%\PrintHood\FIE.dll
- %HOMEPATH%\PrintHood\SHK.dll
- %HOMEPATH%\PrintHood\SIK.dll
- %HOMEPATH%\PrintHood\Roze.dll
- %HOMEPATH%\My Documents\<Имя вируса>.exe.docx
- %HOMEPATH%\PrintHood\Officedesktop.exe
- %HOMEPATH%\PrintHood\mahdi.txt
- %HOMEPATH%\My Documents\<Имя вируса>.exe.txt
- %HOMEPATH%\PrintHood\~yRt9pxdNB9RWHnneTl9A.TMP
- %HOMEPATH%\PrintHood\~8Yo4UcQhZRRj0NYFz5C4.TMP
- %HOMEPATH%\PrintHood\~3vvU842XluP9oOyFKayc.TMP
- %HOMEPATH%\PrintHood\~W4EBgTMg4YbfT7KmVbJ5.TMP
- %HOMEPATH%\PrintHood\~z6JQDIAP8WAwJi0FB0yk.TMP
- %HOMEPATH%\PrintHood\~vxyfXy6P5ujGX6m5YdjP.TMP
- %HOMEPATH%\PrintHood\~lINd3qMp9uSxDZjXAKcA.TMP
- %HOMEPATH%\PrintHood\~lZBz09DuNjMkEThUJoz4.TMP
- %HOMEPATH%\PrintHood\~m3YdkdYGqS4lqcw52Mpj.TMP
- %HOMEPATH%\PrintHood\~1AvmTuWKy4x7kbSGSxl7.TMP
- %HOMEPATH%\PrintHood\~0F4QKKme6dXHEmP66dME.TMP
- %HOMEPATH%\PrintHood\~t7d4rYGJ9RokeX4C4ZXT.TMP
- %HOMEPATH%\PrintHood\~1Jw7zRDNDIB5QTEPGCcC.TMP
- %HOMEPATH%\PrintHood\~Rmoz0acEGuLBZJbFeI8S.TMP
- %HOMEPATH%\PrintHood\~NZamhfBXga56T2OzT1BD.TMP
- %HOMEPATH%\PrintHood\~xGwjilLhKdYIy3BAV9ym.TMP
- %HOMEPATH%\PrintHood\~MtHgAVgLXXE2Han2bc4d.TMP
- %HOMEPATH%\PrintHood\~U8BrXQLdphZQTZb7feo0.TMP
- %HOMEPATH%\PrintHood\~N6TCAGGJwkeI7x1zKDW4.TMP
- %HOMEPATH%\PrintHood\~azSLLaSawIF4BXJ4Ml9d.TMP
- %HOMEPATH%\PrintHood\~kySezSYFFhEarF7u52EQ.TMP
- %HOMEPATH%\PrintHood\~mkbGh6FSqN6LAHVlBbDo.TMP
- %HOMEPATH%\PrintHood\~HQTfrlEXaoXpzvtpgCK8.TMP
- %HOMEPATH%\PrintHood\~6tTRtvbRviY0n3v09Yr6.TMP
- %HOMEPATH%\PrintHood\~YnpM2FiQyOZ4j2ZOgUPw.TMP
- %HOMEPATH%\PrintHood\~1zEqZne34KLSOSPw9mkL.TMP
- %HOMEPATH%\PrintHood\~7hXZalJ1UlmYzgThnQzq.TMP
- %HOMEPATH%\PrintHood\~IOaYSTpaEhJhn6eJGfwc.TMP
- %HOMEPATH%\PrintHood\~O460DXT0DnV3fcvFc6Pc.TMP
- %HOMEPATH%\PrintHood\~GADumooJXUD5alxb40R0.TMP
- %HOMEPATH%\PrintHood\~74lOCZ639DwZHxMD81ZO.TMP
- %HOMEPATH%\PrintHood\~hyqBCz8FnWQrALIJQUAF.TMP
- %HOMEPATH%\PrintHood\~9sSPUtkpO2QBcvAhMKvm.TMP
- %HOMEPATH%\PrintHood\~qRRWDudqQsfu247ixL0e.TMP
- %HOMEPATH%\PrintHood\~E4W1yZV6lSDl5hgW7ggJ.TMP
- %HOMEPATH%\PrintHood\~gVvYUfRzkyBUmJ3WE2OO.TMP
- %HOMEPATH%\PrintHood\~H3gzcBpXJImUBOYnmxx3.TMP
- %HOMEPATH%\PrintHood\~6b8yubLmGEg2bHJxQ4xK.TMP
- %HOMEPATH%\PrintHood\~5lSDwfi7XSFqzBkmpPZN.TMP
- %HOMEPATH%\PrintHood\~aviYccAQZoTsgYg31dkZ.TMP
- %HOMEPATH%\PrintHood\~arfPq3qxCGlnpXU10fdn.TMP
- %HOMEPATH%\PrintHood\~w7GJHUlC92t9RRj9fBKd.TMP
- %HOMEPATH%\PrintHood\~jb0rlqD2vn9CngnPoWWS.TMP
- %HOMEPATH%\PrintHood\~3sPUAy4UwaIlJgdGTcB7.TMP
- %HOMEPATH%\PrintHood\~ylf46sA6Ps4n6ouVsxsg.TMP
- %HOMEPATH%\PrintHood\~SvdmQZ4jnrYtwnGMNVjv.TMP
- %HOMEPATH%\PrintHood\~3mdKEQqQMsmIisd4e9Na.TMP
- %HOMEPATH%\PrintHood\~ExwTRXDAHawk4Mq7EcQQ.TMP
- %HOMEPATH%\PrintHood\~Vz3QYo8g6nSkfIfpGGjI.TMP
- %HOMEPATH%\PrintHood\~cBHWJxUuxjolAzIUgGFb.TMP
- %HOMEPATH%\PrintHood\~4w5C47zfG380YwAMpmvZ.TMP
- %HOMEPATH%\PrintHood\~9Fukx9HE9psRp19IDkp2.TMP
- %HOMEPATH%\PrintHood\~GefBN8tLZPakbLmOgdeY.TMP
- %HOMEPATH%\PrintHood\~WRsIcrG0KeZHCvnAtXlU.TMP
- %HOMEPATH%\PrintHood\~KpVcbGhiIGde0hTu6Y0i.TMP
- %HOMEPATH%\PrintHood\~wxlJgvJk5WRdTE1CvUem.TMP
- %HOMEPATH%\PrintHood\~HSWrzAbR1IzuBJ5Kip0d.TMP
- %HOMEPATH%\PrintHood\~MM0CToLLVKCgDpwxhqYh.TMP
- %HOMEPATH%\PrintHood\~svOJbAgllmwnJY7mQofM.TMP
- %HOMEPATH%\PrintHood\~TTPOTLmJN5BKMfU0ydkT.TMP
- %HOMEPATH%\PrintHood\~zBI4ArpXZE8DaxVslHPY.TMP
- %HOMEPATH%\PrintHood\~Aw4ate37IqwKlrKwuIU1.TMP
- %HOMEPATH%\PrintHood\~54RQer1ZnvvBaO9aoPM5.TMP
- %HOMEPATH%\PrintHood\~koE2oQXDhBSIh8fh6F0E.TMP
- %HOMEPATH%\PrintHood\~0x22Bq5PxUyJrHN74Ywv.TMP
- %HOMEPATH%\PrintHood\~8rUg7beJtMyHrrymEI9u.TMP
- %HOMEPATH%\PrintHood\~fdS46MTvBSccZD5tGtyu.TMP
- %HOMEPATH%\PrintHood\~NGlVBeZv2CqCvpNUCM96.TMP
- %HOMEPATH%\PrintHood\~LDhuBvlq97TYKV2tIHlz.TMP
- %HOMEPATH%\PrintHood\~BImGJojXEnQY24URDiQD.TMP
- %HOMEPATH%\PrintHood\~cXmQO10mHMezUIyD49qF.TMP
- %HOMEPATH%\PrintHood\~PccyqR7JDRxhimQMqTDn.TMP
- %HOMEPATH%\PrintHood\~kp40RLsn10E4aVD7Q8sN.TMP
- %HOMEPATH%\PrintHood\~MpHKpJ0FI110Qm67tsBV.TMP
- %HOMEPATH%\PrintHood\~uxLYF7W9ZA2AT1ynkEKK.TMP
- %HOMEPATH%\PrintHood\~pI1CeaDqek0fYeCwnLbV.TMP
- %HOMEPATH%\PrintHood\~geDV2LritSnZU52ERnnw.TMP
- %HOMEPATH%\PrintHood\~aSx53zuVdTqxDlDJcqG6.TMP
- %HOMEPATH%\PrintHood\~AveZY5td5X1myBKNbvTt.TMP
- %HOMEPATH%\PrintHood\~iHbO8wSJZZ4mzlKr4YWN.TMP
- %HOMEPATH%\PrintHood\~bW5H6Eo7w7Bnue3C6m60.TMP
- %HOMEPATH%\PrintHood\~hSXD7GIPSkKIVU76XpiU.TMP
- %HOMEPATH%\PrintHood\~vQKsWPZb5tAoKeGIfOg8.TMP
- %HOMEPATH%\PrintHood\~6M4kB1FECUToPysm2KTm.TMP
- %HOMEPATH%\PrintHood\~yh2n2Bp6qyQTWm2xbjil.TMP
- %HOMEPATH%\PrintHood\~axG5bODzNTOyKHEQKWMe.TMP
- %HOMEPATH%\PrintHood\~As5YlNEEZrOLVhATKaP3.TMP
- %HOMEPATH%\PrintHood\~8FvC2G2kwF8d94bzwiXI.TMP
- %HOMEPATH%\PrintHood\~rNrE8IlhTEgecMCBpgXK.TMP
- %HOMEPATH%\PrintHood\~SivGxPoREHEVnkdn0A1b.TMP
- %HOMEPATH%\PrintHood\~vACr37KERZGXhhfeO0ST.TMP
- %HOMEPATH%\PrintHood\~dZXpVMZeghTASBuDidPi.TMP
- %HOMEPATH%\PrintHood\~eiOoDTn5x2U23NDTzdMS.TMP
- %HOMEPATH%\PrintHood\~RrdXOFSW7SjzOX4Hkdb0.TMP
- %HOMEPATH%\PrintHood\~S1JB0ekHj3Hjp7iDSmDp.TMP
- %HOMEPATH%\PrintHood\~veDW09a2U4hLtQNWoKeZ.TMP
- %HOMEPATH%\PrintHood\~rNd8fKiDCofpxKV9vu9M.TMP
- %HOMEPATH%\PrintHood\~uQSEfljCpmQiyi8qdmjz.TMP
- %HOMEPATH%\PrintHood\~OLGDB93aZvFPqgBKd4n6.TMP
Удаляет следующие файлы:
- %HOMEPATH%\PrintHood\pangtip.bat
- %HOMEPATH%\My Documents\<Имя вируса>.exe.txt
Сетевая активность:
Подключается к:
- 'localhost':1036
UDP:
- DNS ASK www.ma##kil.in
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: 'http://www.majakil.in/ - ASLASLKK - Windows Internet Explorer'
- ClassName: '' WindowName: 'ASLASLKK - Windows Internet Explorer'
- ClassName: '' WindowName: 'http://www.majakil.in/ - ASLASLKK - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'ASLASLKK - Microsoft Internet Explorer'
