Trojan.DownLoader6.2121

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%HOMEPATH%\Windows\UpdateOffice.exe

Вредоносные функции:

Создает и запускает на исполнение:

%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\Windows\UpdateOffice.exe

Запускает на исполнение:

<SYSTEM32>\ping.exe 174.142.57.27
<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\pangtip.bat" "
<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\700.bat" "

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\PrintHood\2AkSvhCCqB.PRI
%HOMEPATH%\PrintHood\r2oEQ7hA56.PRI
%HOMEPATH%\PrintHood\GIntZUSxYt.PRI
%HOMEPATH%\PrintHood\0VgoZqKb7q.PRI
%HOMEPATH%\PrintHood\O99Clp1BCp.PRI
%HOMEPATH%\PrintHood\DGdHJkwBzr.PRI
%HOMEPATH%\PrintHood\cToAFbDlRR.PRI
%HOMEPATH%\PrintHood\D3hX4STM8D.PRI
%HOMEPATH%\PrintHood\W7Jl7K58UT.PRI
%HOMEPATH%\PrintHood\~d4wiEMHui9iZ8Y8x5BqK.TMP
%HOMEPATH%\PrintHood\~7sGnGkZlzThUgCVicjlS.TMP
%HOMEPATH%\PrintHood\~lRZec2vW71tuBOWlhvCr.TMP
%HOMEPATH%\PrintHood\~LX3o4e20rbN79vTAHBT1.TMP
%HOMEPATH%\PrintHood\~5xDFwucmAWw3amdHgZgS.TMP
%HOMEPATH%\PrintHood\~lFyveUvoZAd0rYQ3BlA0.TMP
%HOMEPATH%\PrintHood\~mUEKUWCtmfnj0WVWbuaQ.TMP
%HOMEPATH%\PrintHood\~tsqGD07yUOK5uekkDdUk.TMP
%HOMEPATH%\PrintHood\~P9tu17bTgJXCvxm9ctYL.TMP
%HOMEPATH%\PrintHood\~RlvPcLV97UfvzHzfhJ11.TMP
%HOMEPATH%\PrintHood\mJWwD3OHaR.PRI
%HOMEPATH%\PrintHood\Abja6Pi0aj.PRI
%HOMEPATH%\PrintHood\bcNhYj8MsD.PRI
%HOMEPATH%\PrintHood\oNFemPpgQv.PRI
%HOMEPATH%\PrintHood\MDaehtGAvC.PRI
%HOMEPATH%\PrintHood\qLIc7WPeh4.PRI
%HOMEPATH%\PrintHood\nJmA0VAOnK.PRI
%HOMEPATH%\PrintHood\rnk6ItOwJN.PRI
%HOMEPATH%\PrintHood\ENQRlgL0Xz.PRI
%HOMEPATH%\PrintHood\rdT5XuRK4H.PRI
%HOMEPATH%\PrintHood\zbw0uAg5hQ.PRI
%HOMEPATH%\PrintHood\GNhRCUlK7M.PRI
%HOMEPATH%\PrintHood\HQLhTlpnQX.PRI
%HOMEPATH%\PrintHood\gWRQk9Vgxp.PRI
%HOMEPATH%\PrintHood\kRVVfCyXYv.PRI
%HOMEPATH%\PrintHood\qye7baPWge.PRI
%HOMEPATH%\PrintHood\73abducIn4.PRI
%HOMEPATH%\PrintHood\abAw7gtolM.PRI
%HOMEPATH%\PrintHood\XDlEnE3BdC.PRI
%HOMEPATH%\PrintHood\~npZVWHfsz3h3r7WcJKzb.TMP
%HOMEPATH%\PrintHood\~XWns0BO2azcm8dvKqxGv.TMP
%HOMEPATH%\PrintHood\~aeds7IclKJXn61KycRmU.TMP
%HOMEPATH%\PrintHood\~XgLhypAVCS2IizdrEZIj.TMP
%HOMEPATH%\PrintHood\~6xASIrWAKwMxFijOSYqn.TMP
%HOMEPATH%\PrintHood\~8M1qbRT3EzMYNOup1Bav.TMP
%HOMEPATH%\PrintHood\~tOckEyTFC60s3ApOJ9pU.TMP
%HOMEPATH%\PrintHood\~dG7XXuXH8sE5dgqC7yRW.TMP
%HOMEPATH%\PrintHood\~ur1nrJwjtBo1eMp3kRmL.TMP
%HOMEPATH%\PrintHood\~hy9iBpcKqg6DxosTBLyM.TMP
%HOMEPATH%\PrintHood\~D8b4khTYnc3eMVUPrFdN.TMP
%HOMEPATH%\PrintHood\~toKQ2195nLqY9mpZZdu9.TMP
%HOMEPATH%\PrintHood\~jid6Q75dS6SygWmQ2hYw.TMP
%HOMEPATH%\PrintHood\~tqDeJfcBWvFXfiiVS05i.TMP
%HOMEPATH%\PrintHood\~oh6iLjR0f79sqk6NGwxC.TMP
%HOMEPATH%\PrintHood\~3EP2Ot5HY4IsDKPjzTJ1.TMP
%HOMEPATH%\PrintHood\~3SAiCSFb54s1KZhM8Gp1.TMP
%HOMEPATH%\PrintHood\~bJiRurqGOBj6ToxE8o3B.TMP
%HOMEPATH%\PrintHood\~7OH9oFgDTE19kfyPQC7p.TMP
%HOMEPATH%\PrintHood\~wLK0p13l5W3GLMLZbva2.TMP
%HOMEPATH%\PrintHood\~M4JXZQD2mAzPg2nxFAwJ.TMP
%HOMEPATH%\PrintHood\~DHuVSnDFBbHJWUfDkB97.TMP
%HOMEPATH%\PrintHood\~8iHd9pxhXusjXL5q6hdq.TMP
%HOMEPATH%\PrintHood\~JJ02JWb02ZmdxOc4kQRl.TMP
%HOMEPATH%\PrintHood\~rUKyZlIrShmHhBlSUsoR.TMP
%HOMEPATH%\PrintHood\~DfcIerRw0oRH2dgh6lgS.TMP
%HOMEPATH%\PrintHood\~J9w2WubPxLhQtB97YMKH.TMP
%HOMEPATH%\PrintHood\~WD1DTTGpNM8JwQMJv8kk.TMP
%HOMEPATH%\PrintHood\~csbSa16WduCpQBL57lbe.TMP
%HOMEPATH%\PrintHood\~CxO5mvrdGjU3FLRCyug6.TMP
%HOMEPATH%\PrintHood\~xH2nyh5RN6xI51GPiWEo.TMP
%HOMEPATH%\PrintHood\~3cj9wfQc9CXwis0O8e5A.TMP
%HOMEPATH%\PrintHood\~rT2w9oimh7hea0b7vw9V.TMP
%HOMEPATH%\PrintHood\~tIv5X6L20P03iS5POLCh.TMP
%HOMEPATH%\PrintHood\~auS748XOuRHiNe6HaOHq.TMP
%HOMEPATH%\PrintHood\~aaK5IRX4zxgMssqfl7hs.TMP
%HOMEPATH%\PrintHood\~1i1VeUppzHBhmnJjICWA.TMP
%HOMEPATH%\PrintHood\~RL8YLoIMnqpCZIiPRxxc.TMP
%HOMEPATH%\PrintHood\~YFILe599RbafpByqogB7.TMP
%HOMEPATH%\PrintHood\iVlLo87TkU.dll
%HOMEPATH%\PrintHood\fCGY89YZXS.dll
%HOMEPATH%\PrintHood\D3OFIE7ZSJ.dll
%HOMEPATH%\PrintHood\sefQcTYvoX.dll
%HOMEPATH%\PrintHood\QiLqxDBe8R.dll
%HOMEPATH%\PrintHood\Dn4LIBjwMT.dll
%HOMEPATH%\PrintHood\YhDGdKvZSc.dll
%HOMEPATH%\PrintHood\Ip1TdgDcjl.dll
%HOMEPATH%\PrintHood\sDodAYgvFo.dll
%HOMEPATH%\PrintHood\7PM9MJQjIf.dll
%HOMEPATH%\PrintHood\3NeDairoHW.dll
%HOMEPATH%\PrintHood\UgYbTuf2uv.dll
%HOMEPATH%\PrintHood\zd4Br59Uud.dll
%HOMEPATH%\PrintHood\gXs2vdUoQH.dll
%HOMEPATH%\PrintHood\NN0IW40GOf.dll
%HOMEPATH%\PrintHood\Z4ygXv03Te.dll
%HOMEPATH%\PrintHood\746dTkBSBj.dll
%HOMEPATH%\PrintHood\ITSGlcv7nt.dll
%HOMEPATH%\PrintHood\fIZfSj0DW1.dll
%HOMEPATH%\PrintHood\SkjjC3hoQc.dll
%HOMEPATH%\PrintHood\xZzq46aXnK.dll
%HOMEPATH%\PrintHood\DZOv5AEZOF.dll
%HOMEPATH%\PrintHood\XW97SxChlq.dll
%HOMEPATH%\PrintHood\TEKPg36rbh.dll
%HOMEPATH%\PrintHood\pangtip.bat
%HOMEPATH%\PrintHood\UPDATE~1.EXE.pkxm
%HOMEPATH%\PrintHood\girchA503b.dll
%HOMEPATH%\Templates\nam.dll
%HOMEPATH%\PrintHood\x5qfGyQ0f3.dll
%HOMEPATH%\PrintHood\Y4DeKYmjZz.dll
%HOMEPATH%\PrintHood\h7mKUZ0q3l.dll
%HOMEPATH%\PrintHood\SdkfYaeUih.dll
%HOMEPATH%\PrintHood\w18WGx1cPs.dll
%HOMEPATH%\PrintHood\Ik0MBgfOXc.dll
%HOMEPATH%\PrintHood\K0Y7hnZUCD.dll
%HOMEPATH%\PrintHood\SZrASM796V.dll
%HOMEPATH%\PrintHood\K8aFlrYAiQ.dll
%HOMEPATH%\PrintHood\Kc0ecLum0C.dll
%HOMEPATH%\PrintHood\aytwKCLkQy.dll
%HOMEPATH%\PrintHood\wayn2g9eFO.PRI
%HOMEPATH%\PrintHood\oQjcVNjrCG.PRI
%HOMEPATH%\PrintHood\pmw9mjH8IQ.PRI
%HOMEPATH%\PrintHood\QNQ2eKKxsv.PRI
%HOMEPATH%\PrintHood\PqAftkiusD.PRI
%HOMEPATH%\PrintHood\ZxXRPg6iRE.PRI
%HOMEPATH%\PrintHood\N8oLBphvMD.PRI
%HOMEPATH%\PrintHood\7o7LIX46Ot.PRI
%HOMEPATH%\PrintHood\EKpZGYpIoN.PRI
%HOMEPATH%\PrintHood\HqQXbVDJ0Z.PRI
%HOMEPATH%\PrintHood\qhY7jm81ga.PRI
%HOMEPATH%\PrintHood\40TMvMrf8q.PRI
%HOMEPATH%\PrintHood\mB2JFLwHsi.PRI
%HOMEPATH%\PrintHood\xTyzMSvyQJ.PRI
%HOMEPATH%\PrintHood\NQYs317bZ4.PRI
%HOMEPATH%\PrintHood\oEVA6wMsQ6.PRI
%HOMEPATH%\PrintHood\9HbIC8pNjA.PRI
%HOMEPATH%\PrintHood\H7JfaRn3YQ.PRI
%HOMEPATH%\PrintHood\7KUraE4ZiZ.PRI
%HOMEPATH%\PrintHood\6UBT3qw9JN.dll
%HOMEPATH%\PrintHood\kQIiHnopUj.dll
%HOMEPATH%\PrintHood\djLm7eG9YV.dll
%HOMEPATH%\PrintHood\jA7THncSjd.dll
%HOMEPATH%\PrintHood\BGyqFzxq1R.dll
%HOMEPATH%\PrintHood\6CVo37FDIs.dll
%HOMEPATH%\PrintHood\YrKnnSjyh3.dll
%HOMEPATH%\PrintHood\yvSYWerbOT.dll
%HOMEPATH%\PrintHood\O4jGR4Serd.dll
%HOMEPATH%\PrintHood\HXZt9R7jra.dll
%HOMEPATH%\PrintHood\bkc9Iyn9AE.PRI
%HOMEPATH%\PrintHood\5nMoZSkeTF.PRI
%HOMEPATH%\PrintHood\0AFYlbGPU0.PRI
%HOMEPATH%\PrintHood\Bxw0KVMYqw.PRI
%HOMEPATH%\PrintHood\FWkGwuPYZA.dll
%HOMEPATH%\PrintHood\PcqeLQDma8.dll
%HOMEPATH%\PrintHood\xqV1HE2HNW.dll
%HOMEPATH%\PrintHood\d3QcdKqaZf.dll
%HOMEPATH%\PrintHood\88DTlPOKDT.dll
%HOMEPATH%\PrintHood\~fwuSNcLnds1rZCfVGv4q.TMP
%HOMEPATH%\PrintHood\~LanK907wLEEeKtH9rE9K.TMP
%HOMEPATH%\PrintHood\~p5HPSELlI7nPMxaFYKwT.TMP
%HOMEPATH%\PrintHood\~7K2E7YgwgsIGnmDAchJ5.TMP
%HOMEPATH%\PrintHood\~TTRPhAX0h45P7AAILZPp.TMP
%HOMEPATH%\PrintHood\~7sxTBPAXViInvCqfFWYz.TMP
%HOMEPATH%\PrintHood\~XnUsNspsz8sgjHT1h1mS.TMP
%HOMEPATH%\PrintHood\~xCVC9XoWIzIVnf9Ldt5s.TMP
%HOMEPATH%\PrintHood\~UPMbl9JErEXKHsjg5tvP.TMP
%HOMEPATH%\PrintHood\~cScgxGvAcXdYvTlQuLDN.TMP
%HOMEPATH%\PrintHood\~NTMzRfVQzGbzncZ1G4aj.TMP
%HOMEPATH%\PrintHood\~ktBsWRvjh2X2C7UoudXg.TMP
%HOMEPATH%\PrintHood\~PbtaAKzv5dW5K3YZj5bj.TMP
%HOMEPATH%\PrintHood\~iLTAPceadfxjLCuNWw9w.TMP
%HOMEPATH%\PrintHood\~Vc4ZBImwHm5F7Er7r4TZ.TMP
%HOMEPATH%\PrintHood\~ksc0n8SJR49BlgxNlJ2Y.TMP
%HOMEPATH%\PrintHood\~9zgXX6UJsj9BOaAigOLG.TMP
%HOMEPATH%\PrintHood\~2l9WcKoQqtLF8yBbr694.TMP
%HOMEPATH%\PrintHood\~IZWbJHQV0rQvSPxaLjs9.TMP
%HOMEPATH%\PrintHood\~mQfBl0KVF7QczlJ6hczW.TMP
%HOMEPATH%\PrintHood\~7FtjHfZxX2MaSXGEvvdN.TMP
%HOMEPATH%\PrintHood\~GPrMkd5qUFib7wRwgskj.TMP
%HOMEPATH%\PrintHood\~52tRaNQNwIRGhy2IRU20.TMP
%HOMEPATH%\PrintHood\~fFF14l26ucJHRXEWAIbL.TMP
%HOMEPATH%\PrintHood\~q85f8jlBdFLd3SXZ7W9J.TMP
%HOMEPATH%\PrintHood\~w3h6AhJPIpeGDyakwQ5g.TMP
%HOMEPATH%\PrintHood\~LcLtfK4gmSPaIYi7xNFU.TMP
%HOMEPATH%\PrintHood\~yKnkWM7amOF0KBJnTPns.TMP
%HOMEPATH%\PrintHood\~doEaGVfTkTkoonprLS5W.TMP
%HOMEPATH%\PrintHood\~F2LKTYVPxfJxVtgp9f4L.TMP
%HOMEPATH%\PrintHood\~uJJRXjW13jUweSbDaZto.TMP
%HOMEPATH%\PrintHood\~Cjq5aENsE4ITnTKmSkxQ.TMP
%HOMEPATH%\PrintHood\~Fezyg7zm5SbwYtADw5uV.TMP
%HOMEPATH%\PrintHood\~bkMrRYHQz5WSkaa0hFcI.TMP
%HOMEPATH%\PrintHood\~aF4wgacCALa3aeo55cV7.TMP
%HOMEPATH%\PrintHood\~q9D81J0kRp00m59Z6asR.TMP
%HOMEPATH%\PrintHood\~VKlS3Ar4tRdHcfa1khLq.TMP
%HOMEPATH%\PrintHood\~qetpXGgYj3xlScpVEMFa.TMP
%HOMEPATH%\PrintHood\~jct1BZIuIGMyH0OyXkLv.TMP
%HOMEPATH%\PrintHood\~1py42EPjISiWjpRLre7k.TMP
%HOMEPATH%\PrintHood\~oxFtAVnlQ469bWtpfzUV.TMP
%HOMEPATH%\PrintHood\~NQsCAxT716JDxlKOV0wd.TMP
%HOMEPATH%\PrintHood\~DAwN4rSqBrvqdEW7vFJ2.TMP
%HOMEPATH%\PrintHood\~XAuAkNr47NqZJ7D3LYWm.TMP
%HOMEPATH%\PrintHood\~xUcprLyKTN6Px0o4q1yb.TMP
%HOMEPATH%\PrintHood\~KPIe7duPBSzw6wynlPBO.TMP
%HOMEPATH%\PrintHood\~pulR9jtr031VZAkwouv5.TMP
%HOMEPATH%\PrintHood\~06lpmGPFmnhLVRQJ3lQS.TMP
%HOMEPATH%\PrintHood\~yUk0Y4impjVS7OktP3Bs.TMP
%HOMEPATH%\PrintHood\~izb0zT088nkViLA65o7a.TMP
%HOMEPATH%\PrintHood\datikal.dll
%HOMEPATH%\PrintHood\~5j8FNcbQVctalN4CrpiJ.TMP
%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\PrintHood\700.bat
%HOMEPATH%\PrintHood\~42AOgV0I7VP4CXMuu3uN.TMP
%HOMEPATH%\PrintHood\~2hIqO9LbKKTNL16s13Z6.TMP
%HOMEPATH%\PrintHood\~4wtq2D3KX813GlZXrozg.TMP
%HOMEPATH%\PrintHood\~l9iuSUrvVm6Avhf8rQnE.TMP
%HOMEPATH%\PrintHood\~XQpHwcixdbzm8xuqko4H.TMP
%HOMEPATH%\PrintHood\~KXcRXAm39NirJkzxA0nW.TMP
%HOMEPATH%\PrintHood\~XQ3UuBbB1VIMIFJrfYli.TMP
%HOMEPATH%\PrintHood\~2d9AqRjlJyYhxQYGMh43.TMP
%HOMEPATH%\PrintHood\~qUpmVbcrOReboTaJD4Cs.TMP
%HOMEPATH%\PrintHood\~wk1VZueqm3CMWScHWI9L.TMP
%HOMEPATH%\PrintHood\~VBjINdv4VTlsLXoUSdfT.TMP
%HOMEPATH%\PrintHood\~WoXqlocSis0T3QImDynr.TMP
%HOMEPATH%\PrintHood\~fGYEcXYL2y92GqyblInr.TMP
%HOMEPATH%\PrintHood\~EwX4aWUz1V2HnjDNdrAV.TMP
%HOMEPATH%\PrintHood\~QCR7dmaD0ENB2eV831wi.TMP
%HOMEPATH%\PrintHood\~UAInKX8InS16vVCtDIhO.TMP
%HOMEPATH%\PrintHood\~KsenbnwRd0GwRZ7yV5rT.TMP
%HOMEPATH%\PrintHood\~46lkht8Mmr28AWA6wUUV.TMP
%HOMEPATH%\PrintHood\~7FxHyDYGiNsZaOlOpSQG.TMP
%HOMEPATH%\PrintHood\~hr1UvnqyyVPDZnk2777V.TMP
%HOMEPATH%\PrintHood\~IY2WvORn3oWjdqWZkDMI.TMP
%HOMEPATH%\PrintHood\~CPaKqfvEZyFwWtqLyCrg.TMP
%HOMEPATH%\PrintHood\~lBBMzvQTubH9uZ8BGMDM.TMP
%HOMEPATH%\PrintHood\~zBbiSr99HrsWLYGkBWAc.TMP
%HOMEPATH%\PrintHood\~WccVTf7ZnvctVObje581.TMP
%HOMEPATH%\PrintHood\~8vcnhT3Xtu0DK9ql6Hxk.TMP
%HOMEPATH%\PrintHood\~SHNnvVSqTNw2cIOCNVeM.TMP
%HOMEPATH%\PrintHood\~7hug3xXbSc64I0dG4heF.TMP
%HOMEPATH%\PrintHood\~5Qdzx7odsr89vzI6tz7T.TMP
%HOMEPATH%\PrintHood\~zI6SMD6SPnTvD3KiGWIT.TMP
%HOMEPATH%\PrintHood\~T6uhBcOU76Ova8wy80jt.TMP
%HOMEPATH%\PrintHood\~RJVvDsQOYXQ3NUsOumq3.TMP
%HOMEPATH%\PrintHood\~82qDNy73Y1PpcWztFtUQ.TMP
%HOMEPATH%\PrintHood\~EX0jV5CtJeCuSkzc8ajv.TMP
%HOMEPATH%\PrintHood\~TNrbhROOFv4BU3RdcEDQ.TMP
%HOMEPATH%\PrintHood\~DZmSBh2zPyZEKWluMqK9.TMP
%HOMEPATH%\PrintHood\~SDyC2U6PKJEmrM2MMetc.TMP
%HOMEPATH%\PrintHood\~RgvVeFfK25iacgOz4sW8.TMP
%HOMEPATH%\PrintHood\~o9eW7mzYN6QArm2lBIpS.TMP
%HOMEPATH%\PrintHood\~0g2nP6RcURWUgwHIKHTL.TMP
%HOMEPATH%\PrintHood\~jkD1Hzc6TivVpOc8wqEC.TMP
%HOMEPATH%\PrintHood\~8YAiSDD2U8VEQuYkhRK9.TMP
%HOMEPATH%\PrintHood\~427PILEbhq9SSezoo18q.TMP
%HOMEPATH%\PrintHood\~qltDceZuuivjfdxC36jX.TMP
%HOMEPATH%\PrintHood\~kTakrPc5ZAmoSprqfiyM.TMP
%HOMEPATH%\PrintHood\~zLCwotzXx6zo3Vt61bS7.TMP
%HOMEPATH%\PrintHood\~nbOT65JAWVe04DV7X7c5.TMP
%HOMEPATH%\PrintHood\~s8sC9k8yZM938MLge0Ia.TMP
%HOMEPATH%\PrintHood\~KWfmh8co2aQAMTqQbRk7.TMP
%HOMEPATH%\PrintHood\~7JYXRmQUC5fZ8v3kASzg.TMP
%HOMEPATH%\PrintHood\~eckAJtlqLJ7Kv95Bl2z9.TMP
%HOMEPATH%\PrintHood\~ttlJeT30cjHQCXrK6ZzL.TMP
%HOMEPATH%\PrintHood\~8JkegvnnZFBJXK8UuMAC.TMP
%HOMEPATH%\PrintHood\~EioPYYp2ToKEzVT6kdHq.TMP
%HOMEPATH%\PrintHood\~AXRYjEZejlWk99BPAhSK.TMP
%HOMEPATH%\PrintHood\~g5tWvyY7r7Zv2U4lFZwk.TMP
%HOMEPATH%\PrintHood\~CSd12YsyMT5wUg1Y8CDQ.TMP
%HOMEPATH%\PrintHood\~p9fDOGYpONzaypEgV7oT.TMP
%HOMEPATH%\PrintHood\~BZt4YELp0YzvdUfQbtMR.TMP
%HOMEPATH%\PrintHood\~bopjBI6JMBPgCDXt53vA.TMP
%HOMEPATH%\PrintHood\~gWeF8LJvOdegWAaHQXcW.TMP
%HOMEPATH%\PrintHood\~zcPHykyROmHglJpW0tVe.TMP
%HOMEPATH%\PrintHood\~kFhzq4EX8aJKszzi5PX7.TMP
%HOMEPATH%\PrintHood\~YE1HLn4ANjPRDMzdAUMt.TMP
%HOMEPATH%\PrintHood\~cfyAiyxZMJb4VOsAAa9N.TMP
%HOMEPATH%\PrintHood\~FZx4QBpImAD5SZJ2lmWN.TMP
%HOMEPATH%\PrintHood\~MiiPPAbsE0tCfqLSoIEH.TMP
%HOMEPATH%\PrintHood\~UNmfdjY3S36fj0yeQFux.TMP
%HOMEPATH%\PrintHood\~YlZqz1v88dFWdGL6iAEh.TMP
%HOMEPATH%\PrintHood\~t02833p91zCONCoDcbgR.TMP
%HOMEPATH%\PrintHood\~itOhKYNT4LSpFeJzevR9.TMP
%HOMEPATH%\PrintHood\~pPn322uhDPU8RtNWEaP4.TMP
%HOMEPATH%\PrintHood\~G0GWaPCkYCZmwx8Ev0bm.TMP
%HOMEPATH%\PrintHood\~gJASQ83aal7uqa2ne29b.TMP
%HOMEPATH%\PrintHood\~dpirlAgLCHSGJpD1IAy4.TMP
%HOMEPATH%\PrintHood\~bgQjwDZJZroNm9B8UgG1.TMP
%HOMEPATH%\PrintHood\~RXCerZ9pwR0FaOKGVUi2.TMP
%HOMEPATH%\PrintHood\~eAmT7gaAdzBoO9naqKh6.TMP
%HOMEPATH%\PrintHood\~m8rtpy1GBYsB3U7ShyG4.TMP
%HOMEPATH%\PrintHood\~5VGBO0ESwK0uvtUwojqk.TMP
%HOMEPATH%\PrintHood\~l0VwmLwxFVQwNWYaKNum.TMP
%HOMEPATH%\PrintHood\~i1Ek6Ellrsj2XoGp7MJ3.TMP
%HOMEPATH%\PrintHood\~FcI1IzRqewRDCxTDj7Tl.TMP
%HOMEPATH%\PrintHood\~gKF9e93Q6mNeXCFu261D.TMP
%HOMEPATH%\PrintHood\~5j1IZnAh8qwwM4YlXhm3.TMP
%HOMEPATH%\PrintHood\~WgXDAK9J9LDD5ifg8nHS.TMP
%HOMEPATH%\PrintHood\~hvJJZyxmksQesqRlhOOW.TMP
%HOMEPATH%\PrintHood\~bNtsYM5j0YYAnr34BGB3.TMP
%HOMEPATH%\PrintHood\~Y84mn5VKU1M42AQExyHz.TMP
%HOMEPATH%\PrintHood\~bAIqG9aOdtNFm9hshVKA.TMP
%HOMEPATH%\PrintHood\~gI3aSBy19tLZrN1gv9ay.TMP
%HOMEPATH%\PrintHood\~qZSKOTUnj2lUvWLPuhe7.TMP
%HOMEPATH%\PrintHood\~kr7F7l4U4tyvA1bs7snf.TMP
%HOMEPATH%\PrintHood\~yf7nReKPtGFaPoRAz58F.TMP
%HOMEPATH%\PrintHood\~MbIVjRZUiVZUEXZGmoQk.TMP
%HOMEPATH%\PrintHood\~LoXgFkEOFSIht6qmMA7f.TMP
%HOMEPATH%\PrintHood\~wA7CvcCUBKkJpEO7KFDa.TMP
%HOMEPATH%\PrintHood\~I5FOgxbSoGIgqLOr1wSQ.TMP
%HOMEPATH%\PrintHood\~oiQopiEPc9FucjtFjor3.TMP
%HOMEPATH%\PrintHood\~mdOaBYPDeyCoMHDzGzyQ.TMP
%HOMEPATH%\PrintHood\~wCXdCUcM85EoU5z0WEeo.TMP

Удаляет следующие файлы:

%HOMEPATH%\PrintHood\pangtip.bat

Сетевая активность:

Подключается к:

'localhost':1035

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: '' WindowName: 'http://174.142.57.27/ - u!u!u!u! - Windows Internet Explorer'
ClassName: '' WindowName: 'u!u!u!u! - Windows Internet Explorer'
ClassName: '' WindowName: 'http://174.142.57.27/ - u!u!u!u! - Microsoft Internet Explorer'
ClassName: '' WindowName: 'u!u!u!u! - Microsoft Internet Explorer'

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней