マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Trojan.MulDrop5.19107

Added to the Dr.Web virus database: 2014-05-06

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Mn86663W55394' = '%HOMEPATH%\Mh24922J48114\hackdee.exe'
Malicious functions:
Creates and executes the following:
  • '%HOMEPATH%\Mh24922J48114\hackdee.exe'
Modifies file system :
Creates the following files:
  • %HOMEPATH%\Mh24922J48114\M43648C84466.NIN
  • %HOMEPATH%\Mh24922J48114\J18331F86694.YGU
  • %HOMEPATH%\Mh24922J48114\L50474Q1785.UTB
  • %HOMEPATH%\Mh24922J48114\T69804D3049.PNL
  • %HOMEPATH%\Mh24922J48114\72128.TIF
  • %HOMEPATH%\Mh24922J48114\M1927G4651.MDG
  • %HOMEPATH%\Mh24922J48114\93447.SRS
  • %HOMEPATH%\Mh24922J48114\49286.SKT
  • %HOMEPATH%\Mh24922J48114\L8294G50812.ULR
  • %HOMEPATH%\Mh24922J48114\J47376V29604.JZG
  • %HOMEPATH%\Mh24922J48114\T9778X11446.HTR
  • %HOMEPATH%\Mh24922J48114\H47913F77742.COL
  • %HOMEPATH%\Mh24922J48114\18887.SNR
  • %HOMEPATH%\Mh24922J48114\11897.IBA
  • %HOMEPATH%\Mh24922J48114\Q66960A6121.IUJ
  • %HOMEPATH%\Mh24922J48114\90549.HER
  • %HOMEPATH%\Mh24922J48114\F83521Q70429.QYU
  • %HOMEPATH%\Mh24922J48114\W37011K66950.VGP
  • %HOMEPATH%\Mh24922J48114\60328.SJT
  • %HOMEPATH%\Mh24922J48114\50169.APH
  • %HOMEPATH%\Mh24922J48114\2492.LJA
  • %HOMEPATH%\Mh24922J48114\70591.ESV
  • %HOMEPATH%\Mh24922J48114\77665.RNS
  • %HOMEPATH%\Mh24922J48114\2022.JEI
  • %HOMEPATH%\Mh24922J48114\1209.VWY
  • %HOMEPATH%\Mh24922J48114\58802.CLK
  • %HOMEPATH%\Mh24922J48114\O93634O91654.UDJ
  • %HOMEPATH%\Mh24922J48114\O82908X52073.FKS
  • %HOMEPATH%\Mh24922J48114\U22205Z37230.PSB
  • %HOMEPATH%\Mh24922J48114\83965.ZSB
  • %HOMEPATH%\Mh24922J48114\24011.FMN
  • %HOMEPATH%\Mh24922J48114\40500.WWA
  • %HOMEPATH%\Mh24922J48114\18839.GAP
  • %HOMEPATH%\Mh24922J48114\L24260F20471.VQA
  • %HOMEPATH%\Mh24922J48114\77520.FIJ
  • %HOMEPATH%\Mh24922J48114\N46366Z67579.RCV
  • %HOMEPATH%\Mh24922J48114\A77460B28843.LGX
  • %HOMEPATH%\Mh24922J48114\86775.ELE
  • %HOMEPATH%\Mh24922J48114\V15751H60709.XXN
  • %HOMEPATH%\Mh24922J48114\54390.GDD
  • %HOMEPATH%\Mh24922J48114\94226.XSD
  • %HOMEPATH%\Mh24922J48114\3397.ZLV
  • %HOMEPATH%\Mh24922J48114\26218.ULS
  • %HOMEPATH%\Mh24922J48114\70226.SXU
  • %HOMEPATH%\Mh24922J48114\E39440Q62740.GUW
  • %HOMEPATH%\Mh24922J48114\57254.DQU
  • %HOMEPATH%\Mh24922J48114\R92986R67561.ZNT
  • %HOMEPATH%\Mh24922J48114\76044.CZQ
  • %HOMEPATH%\Mh24922J48114\Q11239W7859.YPM
  • %HOMEPATH%\Mh24922J48114\M32811Q89434.LAC
  • %HOMEPATH%\Mh24922J48114\3018.KVA
  • %HOMEPATH%\Mh24922J48114\T60602O91601.NUU
  • %HOMEPATH%\Mh24922J48114\95723.ENG
  • %HOMEPATH%\Mh24922J48114\60535.UOK
  • %HOMEPATH%\Mh24922J48114\71557.ATM
  • %HOMEPATH%\Mh24922J48114\Z97341A56290.MZN
  • %HOMEPATH%\Mh24922J48114\X31027C96367.IDG
  • %HOMEPATH%\Mh24922J48114\B38427Y51813.JZM
  • %HOMEPATH%\Mh24922J48114\72229.XXZ
  • %HOMEPATH%\Mh24922J48114\A87311G81393.XHC
  • %HOMEPATH%\Mh24922J48114\24950.CCK
  • %HOMEPATH%\Mh24922J48114\N77825A4991.VYW
  • %HOMEPATH%\Mh24922J48114\L51496D93254.YOD
  • %HOMEPATH%\Mh24922J48114\O84247I11272.YSN
  • %HOMEPATH%\Mh24922J48114\83317.TZL
  • %HOMEPATH%\Mh24922J48114\20044.QFD
  • %HOMEPATH%\Mh24922J48114\B55584I37136.MXN
  • %HOMEPATH%\Mh24922J48114\66443.PFL
  • %HOMEPATH%\Mh24922J48114\96014.RLX
  • %HOMEPATH%\Mh24922J48114\39314.KJI
  • %HOMEPATH%\Mh24922J48114\15865.YUB
  • %HOMEPATH%\Mh24922J48114\Q39859G19560.VVH
  • %HOMEPATH%\Mh24922J48114\45940.EIY
  • %HOMEPATH%\Mh24922J48114\A87126V22675.XDA
  • %HOMEPATH%\Mh24922J48114\X76986L6563.RAV
  • %HOMEPATH%\Mh24922J48114\A65371I92407.GOQ
  • %HOMEPATH%\Mh24922J48114\J42228M31236.WTY
  • %HOMEPATH%\Mh24922J48114\16666.ITS
  • %HOMEPATH%\Mh24922J48114\26970.OWK
  • %HOMEPATH%\Mh24922J48114\U32437L41542.LOW
  • %HOMEPATH%\Mh24922J48114\6530.ACO
  • %HOMEPATH%\Mh24922J48114\15026.OLR
  • %HOMEPATH%\Mh24922J48114\P27038D46469.NGA
  • %HOMEPATH%\Mh24922J48114\N36370U50574.ARS
  • %HOMEPATH%\Mh24922J48114\41424.BKP
  • %HOMEPATH%\Mh24922J48114\13553.FHE
  • %HOMEPATH%\Mh24922J48114\26779.GZA
  • %HOMEPATH%\Mh24922J48114\92459.HTC
  • %HOMEPATH%\Mh24922J48114\O10625H66072.UJG
  • %HOMEPATH%\Mh24922J48114\N13279V87891.BHH
  • %HOMEPATH%\Mh24922J48114\X51022R2959.PQC
  • %HOMEPATH%\Mh24922J48114\M45978P12504.PTY
  • %HOMEPATH%\Mh24922J48114\R64071I90721.WRG
  • %HOMEPATH%\Mh24922J48114\93188.XPW
  • %HOMEPATH%\Mh24922J48114\X81780F82898.SFV
  • %HOMEPATH%\Mh24922J48114\59318.QJJ
  • %HOMEPATH%\Mh24922J48114\43452.NKS
  • %HOMEPATH%\Mh24922J48114\13919.LDJ
  • %HOMEPATH%\Mh24922J48114\Z29418F96730.ZFG
  • %HOMEPATH%\Mh24922J48114\60830.MLE
  • %HOMEPATH%\Mh24922J48114\H50087I48077.QUU
  • %HOMEPATH%\Mh24922J48114\1915.HTI
  • %HOMEPATH%\Mh24922J48114\K37055N55564.LSL
  • %HOMEPATH%\Mh24922J48114\72944.UAI
  • %HOMEPATH%\Mh24922J48114\9873.YOC
  • %HOMEPATH%\Mh24922J48114\5691.USR
  • %HOMEPATH%\Mh24922J48114\45823.SNF
  • %HOMEPATH%\Mh24922J48114\K11312X83864.YQW
  • %HOMEPATH%\Mh24922J48114\W29490C61400.TDY
  • %HOMEPATH%\Mh24922J48114\5028.PBG
  • %HOMEPATH%\Mh24922J48114\58152.LZY
  • %HOMEPATH%\Mh24922J48114\18331.BEX
  • %HOMEPATH%\Mh24922J48114\H37503F77118.VNL
  • %HOMEPATH%\Mh24922J48114\33987.AEY
  • %HOMEPATH%\Mh24922J48114\99535.GNO
  • %HOMEPATH%\Mh24922J48114\Q34812C22652.GNG
  • %HOMEPATH%\Mh24922J48114\22428.NGV
  • %HOMEPATH%\Mh24922J48114\76573.FJZ
  • %HOMEPATH%\Mh24922J48114\86851.TDD
  • %HOMEPATH%\Mh24922J48114\83065.JUF
  • %HOMEPATH%\Mh24922J48114\I91164B52272.BIA
  • %HOMEPATH%\Mh24922J48114\E63260K1095.PJR
  • %HOMEPATH%\Mh24922J48114\U58929U60071.VDS
  • %HOMEPATH%\Mh24922J48114\N33909R76404.RUU
  • %HOMEPATH%\Mh24922J48114\7305.XRZ
  • %HOMEPATH%\Mh24922J48114\E20796V17477.IGY
  • %HOMEPATH%\Mh24922J48114\G5206T97658.IMM
  • %HOMEPATH%\Mh24922J48114\39778.MKG
  • %HOMEPATH%\Mh24922J48114\98903.IYQ
  • %HOMEPATH%\Mh24922J48114\9130.ISO
  • %HOMEPATH%\Mh24922J48114\B65322U48982.RLR
  • %HOMEPATH%\Mh24922J48114\63907.VFF
  • %HOMEPATH%\Mh24922J48114\U17379J34401.RPC
  • %HOMEPATH%\Mh24922J48114\15488.OOY
  • %HOMEPATH%\Mh24922J48114\M32145M67577.LUZ
  • %HOMEPATH%\Mh24922J48114\68437.VGP
  • %HOMEPATH%\Mh24922J48114\74900.MAR
  • %HOMEPATH%\Mh24922J48114\71978.EEM
  • %HOMEPATH%\Mh24922J48114\E55692J38411.MEL
  • %HOMEPATH%\Mh24922J48114\U11938O83771.PEW
  • %HOMEPATH%\Mh24922J48114\45938.NRU
  • %HOMEPATH%\Mh24922J48114\74352.QUO
  • %HOMEPATH%\Mh24922J48114\Z88899B10233.MAR
  • %HOMEPATH%\Mh24922J48114\Q81500V81940.PXT
  • %HOMEPATH%\Mh24922J48114\66857.FUB
  • %HOMEPATH%\Mh24922J48114\Q34115Y8169.MPV
  • %HOMEPATH%\Mh24922J48114\14216.VFO
  • %HOMEPATH%\Mh24922J48114\F46414O22042.ZNP
  • %HOMEPATH%\Mh24922J48114\66816.GAM
  • %HOMEPATH%\Mh24922J48114\84724.BTL
  • %HOMEPATH%\Mh24922J48114\60738.KAT
  • %HOMEPATH%\Mh24922J48114\91308.OVQ
  • %HOMEPATH%\Mh24922J48114\46309.CGD
  • %HOMEPATH%\Mh24922J48114\49883.JIQ
  • %HOMEPATH%\Mh24922J48114\R68338B19232.RXF
  • %HOMEPATH%\Mh24922J48114\J48356G32499.QMZ
  • %HOMEPATH%\Mh24922J48114\Z87884Q13237.SVO
  • %HOMEPATH%\Mh24922J48114\Z23301E18079.CQM
  • %HOMEPATH%\Mh24922J48114\40628.WWR
  • %HOMEPATH%\Mh24922J48114\B37511D37074.VNB
  • %HOMEPATH%\Mh24922J48114\94691.SGY
  • %HOMEPATH%\Mh24922J48114\K50402A11374.JDS
  • %HOMEPATH%\Mh24922J48114\B83392C26813.SGX
  • %HOMEPATH%\Mh24922J48114\Z87698Z77985.KUY
  • %HOMEPATH%\Mh24922J48114\S40942D7140.QQK
  • %HOMEPATH%\Mh24922J48114\M4289R35417.AVH
  • %HOMEPATH%\Mh24922J48114\55314.HQV
  • %HOMEPATH%\Mh24922J48114\44062.UNG
  • %HOMEPATH%\Mh24922J48114\A22922H38244.RIS
  • %HOMEPATH%\Mh24922J48114\A8789M91297.YWT
  • %HOMEPATH%\Mh24922J48114\2694.ONE
  • %HOMEPATH%\Mh24922J48114\H23811X55416.GID
  • %HOMEPATH%\Mh24922J48114\94004.EHT
  • %HOMEPATH%\Mh24922J48114\T67525Y50401.GHO
  • %HOMEPATH%\Mh24922J48114\P43261A15157.HAC
  • %HOMEPATH%\Mh24922J48114\R31456G42457.RFN
  • %HOMEPATH%\Mh24922J48114\E10921W82364.JTQ
  • %HOMEPATH%\Mh24922J48114\P7382T94098.LTC
  • %HOMEPATH%\Mh24922J48114\90412.LQX
  • %HOMEPATH%\Mh24922J48114\39184.UIZ
  • %HOMEPATH%\Mh24922J48114\39405.XAR
  • %HOMEPATH%\Mh24922J48114\D58144O26052.BMH
  • %HOMEPATH%\Mh24922J48114\X77372X38548.PLB
  • %HOMEPATH%\Mh24922J48114\S32051H38423.XDK
  • %HOMEPATH%\Mh24922J48114\96122.LBG
  • %HOMEPATH%\Mh24922J48114\O50780B94425.UPW
  • %HOMEPATH%\Mh24922J48114\P70437K51571.OKK
  • %HOMEPATH%\Mh24922J48114\O67011I59010.EEH
  • %HOMEPATH%\Mh24922J48114\20039.GOQ
  • %HOMEPATH%\Mh24922J48114\12052.GPR
  • %HOMEPATH%\Mh24922J48114\S74218N10532.ARM
  • %HOMEPATH%\Mh24922J48114\L63832Y74513.KLP
  • %HOMEPATH%\Mh24922J48114\59704.QEB
  • %HOMEPATH%\Mh24922J48114\60476.RVC
  • %HOMEPATH%\Mh24922J48114\58024.VCR
  • %HOMEPATH%\Mh24922J48114\F39481M8366.UZS
  • %HOMEPATH%\Mh24922J48114\K60791H23112.TWB
  • %HOMEPATH%\Mh24922J48114\26741.IBE
  • C:\hackdee.exe
  • %HOMEPATH%\Mh24922J48114\GO.XEP
  • %HOMEPATH%\Mv50307Y41999.WG2
  • %TEMP%\aut1.tmp
  • %HOMEPATH%\Mh24922J48114\B84021U84074.WRI
  • %HOMEPATH%\Mh24922J48114\34988.OPT
  • %HOMEPATH%\Mh24922J48114\P78111P33239.LBO
  • %HOMEPATH%\Mh24922J48114\14848.FCZ
  • %HOMEPATH%\Mh24922J48114\H16431J32040.IRT
  • %HOMEPATH%\Mh24922J48114\K15807G2722.RLB
  • %HOMEPATH%\Mh24922J48114\J92953W96396.PWF
  • %HOMEPATH%\Mh24922J48114\55527.QJH
  • %HOMEPATH%\Mh24922J48114\N3586I46217.LKG
  • %HOMEPATH%\Mh24922J48114\Z27922U36121.VGJ
  • %HOMEPATH%\Mh24922J48114\15047.MLI
  • %HOMEPATH%\Mh24922J48114\D36402X31422.LVG
  • %HOMEPATH%\Mh24922J48114\37280.IDL
  • %HOMEPATH%\Mh24922J48114\39250.YTN
  • %HOMEPATH%\Mh24922J48114\4808.LPY
  • %HOMEPATH%\Mh24922J48114\8422.XIW
  • %HOMEPATH%\Mh24922J48114\44979.FIJ
  • %HOMEPATH%\Mh24922J48114\78042.FNE
  • %HOMEPATH%\Mh24922J48114\N64159U84605.ZYX
  • %HOMEPATH%\Mh24922J48114\3837.VHH
  • %HOMEPATH%\Mh24922J48114\Z85688N68243.IEE
  • %HOMEPATH%\Mh24922J48114\31785.PNQ
  • %HOMEPATH%\Mh24922J48114\95824.OEY
  • %HOMEPATH%\Mh24922J48114\61666.YTO
  • %HOMEPATH%\Mh24922J48114\27341.LLW
  • %HOMEPATH%\Mh24922J48114\80904.WKT
  • %HOMEPATH%\Mh24922J48114\25533.DJI
  • %HOMEPATH%\Mh24922J48114\F62875U24524.IHZ
  • %HOMEPATH%\Mh24922J48114\65683.DVR
  • %HOMEPATH%\Mh24922J48114\A33655P89790.GRP
  • %HOMEPATH%\Mh24922J48114\54139.SNY
  • %HOMEPATH%\Mh24922J48114\S50325D61861.UOJ
  • %HOMEPATH%\Mh24922J48114\J24457R7873.ZKN
  • %HOMEPATH%\Mh24922J48114\O69062E18638.CHW
  • %HOMEPATH%\Mh24922J48114\S35229K20641.PYW
  • %HOMEPATH%\Mh24922J48114\37886.DEF
  • %HOMEPATH%\Mh24922J48114\85225.JHO
  • %HOMEPATH%\Mh24922J48114\99704.TAE
  • %HOMEPATH%\Mh24922J48114\Q46169Q78507.HRG
  • %HOMEPATH%\Mh24922J48114\U90314C60777.OLR
  • %HOMEPATH%\Mh24922J48114\M88681V77726.UOX
  • %HOMEPATH%\Mh24922J48114\M60316C84495.CJT
  • %HOMEPATH%\Mh24922J48114\N84833A8755.DEL
  • %HOMEPATH%\Mh24922J48114\37215.RTA
  • %HOMEPATH%\Mh24922J48114\23967.EZI
  • %HOMEPATH%\Mh24922J48114\K71914D18996.DCI
  • %HOMEPATH%\Mh24922J48114\38998.LSF
  • %HOMEPATH%\Mh24922J48114\H67685O40024.BAN
  • %HOMEPATH%\Mh24922J48114\B32399V53338.PNC
  • %HOMEPATH%\Mh24922J48114\O8867L81945.XFN
  • %HOMEPATH%\Mh24922J48114\U40331K13749.WIU
  • %HOMEPATH%\Mh24922J48114\64840.FUD
  • %HOMEPATH%\Mh24922J48114\P60213Q37354.GTG
  • %HOMEPATH%\Mh24922J48114\U55857J26213.QTJ
  • %HOMEPATH%\Mh24922J48114\70165.CEY
  • %HOMEPATH%\Mh24922J48114\60555.ZHT
  • %HOMEPATH%\Mh24922J48114\A56827T22151.TUA
  • %HOMEPATH%\Mh24922J48114\61923.OEX
  • %HOMEPATH%\Mh24922J48114\7627.XKK
  • %HOMEPATH%\Mh24922J48114\K52088K45828.MPV
  • %HOMEPATH%\Mh24922J48114\S5026J1918.KAW
  • %HOMEPATH%\Mh24922J48114\V13666G21937.ZRO
  • %HOMEPATH%\Mh24922J48114\W45116G88771.JPY
  • %HOMEPATH%\Mh24922J48114\73477.EYX
  • %HOMEPATH%\Mh24922J48114\K38088P9464.WBX
  • %HOMEPATH%\Mh24922J48114\94830.QTQ
  • %HOMEPATH%\Mh24922J48114\I92166G28901.HEQ
  • %HOMEPATH%\Mh24922J48114\C86573F2690.IVJ
  • %HOMEPATH%\Mh24922J48114\D18911O40877.POT
  • %HOMEPATH%\Mh24922J48114\31517.LAG
  • %HOMEPATH%\Mh24922J48114\2739.YSL
  • %HOMEPATH%\Mh24922J48114\Q23630E47128.GVW
  • %HOMEPATH%\Mh24922J48114\O72133N84863.ISX
  • %HOMEPATH%\Mh24922J48114\65837.CVQ
  • %HOMEPATH%\Mh24922J48114\Q95886N28233.SUK
  • %HOMEPATH%\Mh24922J48114\55791.GYI
  • %HOMEPATH%\Mh24922J48114\J65634C73140.FUU
  • %HOMEPATH%\Mh24922J48114\50781.RLA
  • %HOMEPATH%\Mh24922J48114\Q21881R41748.ICB
  • %HOMEPATH%\Mh24922J48114\D35677Y84953.CST
  • %HOMEPATH%\Mh24922J48114\D53865T95924.OGE
  • %HOMEPATH%\Mh24922J48114\23726.TDA
  • %HOMEPATH%\Mh24922J48114\L88512M2571.RZZ
  • %HOMEPATH%\Mh24922J48114\1979.KAB
  • %HOMEPATH%\Mh24922J48114\P99020N39707.TUG
  • %HOMEPATH%\Mh24922J48114\E70186M74124.MFH
  • %HOMEPATH%\Mh24922J48114\U68939A33314.IBQ
  • %HOMEPATH%\Mh24922J48114\P54126V2154.BZU
  • %HOMEPATH%\Mh24922J48114\W37140Z13127.MCK
  • %HOMEPATH%\Mh24922J48114\73796.IKH
  • %HOMEPATH%\Mh24922J48114\S16270U57455.FGU
  • %HOMEPATH%\Mh24922J48114\Z23750L47583.XHE
  • %HOMEPATH%\Mh24922J48114\W45393V96653.JLT
  • %HOMEPATH%\Mh24922J48114\13937.ERM
  • %HOMEPATH%\Mh24922J48114\X35775H82224.NGX
  • %HOMEPATH%\Mh24922J48114\X35270V78653.TOY
  • %HOMEPATH%\Mh24922J48114\61776.WGD
  • %HOMEPATH%\Mh24922J48114\17667.HRD
  • %HOMEPATH%\Mh24922J48114\D94866T88262.SEE
  • %HOMEPATH%\Mh24922J48114\60696.YAT
  • %HOMEPATH%\Mh24922J48114\52758.DAM
  • %HOMEPATH%\Mh24922J48114\40440.NUC
  • %HOMEPATH%\Mh24922J48114\52589.YBA
  • %HOMEPATH%\Mh24922J48114\N16204F22870.RWF
  • %HOMEPATH%\Mh24922J48114\I90245Z18920.LHA
  • %HOMEPATH%\Mh24922J48114\E88797X15827.EEE
  • %HOMEPATH%\Mh24922J48114\11234.HZU
  • %HOMEPATH%\Mh24922J48114\E12574X19799.BNG
  • %HOMEPATH%\Mh24922J48114\W23366T99578.NCS
  • %HOMEPATH%\Mh24922J48114\94617.HUX
  • %HOMEPATH%\Mh24922J48114\17481.DUP
  • %HOMEPATH%\Mh24922J48114\68152.ZNP
  • %HOMEPATH%\Mh24922J48114\I10360F37380.RBE
  • %HOMEPATH%\Mh24922J48114\32525.MDZ
  • %HOMEPATH%\Mh24922J48114\U58391J25277.BNB
  • %HOMEPATH%\Mh24922J48114\94653.BCY
  • %HOMEPATH%\Mh24922J48114\68708.KJL
  • %HOMEPATH%\Mh24922J48114\46958.LRA
  • %HOMEPATH%\Mh24922J48114\M28879A81945.TLK
  • %HOMEPATH%\Mh24922J48114\25351.GZV
  • %HOMEPATH%\Mh24922J48114\B37343K30813.YLR
  • %HOMEPATH%\Mh24922J48114\Q88152C21415.BUL
  • %HOMEPATH%\Mh24922J48114\2682.WVM
  • %HOMEPATH%\Mh24922J48114\15778.DJD
  • %HOMEPATH%\Mh24922J48114\89652.BWF
  • %HOMEPATH%\Mh24922J48114\Y28816M27024.LCX
  • %HOMEPATH%\Mh24922J48114\F48386Z4399.SIK
  • %HOMEPATH%\Mh24922J48114\Y56134Q74305.DCO
  • %HOMEPATH%\Mh24922J48114\23608.TNV
  • %HOMEPATH%\Mh24922J48114\S17406I79203.NHJ
  • %HOMEPATH%\Mh24922J48114\45725.VWT
  • %HOMEPATH%\Mh24922J48114\D36921E93877.AAP
  • %HOMEPATH%\Mh24922J48114\49644.OWH
  • %HOMEPATH%\Mh24922J48114\91713.TQN
  • %HOMEPATH%\Mh24922J48114\V36827P82586.HJM
  • %HOMEPATH%\Mh24922J48114\79114.XKR
  • %HOMEPATH%\Mh24922J48114\2110.NTB
  • %HOMEPATH%\Mh24922J48114\E39525Z24004.BNE
  • %HOMEPATH%\Mh24922J48114\10423.ZLI
  • %HOMEPATH%\Mh24922J48114\G71314S76667.XMG
  • %HOMEPATH%\Mh24922J48114\38019.JVA
  • %HOMEPATH%\Mh24922J48114\L35014G68543.UYO
  • %HOMEPATH%\Mh24922J48114\Z35479T25647.RUB
  • %HOMEPATH%\Mh24922J48114\S78613P81586.XRC
  • %HOMEPATH%\Mh24922J48114\V70182E45797.RHZ
  • %HOMEPATH%\Mh24922J48114\69743.NBE
  • %HOMEPATH%\Mh24922J48114\50863.KIB
  • %HOMEPATH%\Mh24922J48114\6676.RWY
  • %HOMEPATH%\Mh24922J48114\63759.CRR
  • %HOMEPATH%\Mh24922J48114\2065.JXG
  • %HOMEPATH%\Mh24922J48114\67759.FYS
  • %HOMEPATH%\Mh24922J48114\L8623M51446.MET
  • %HOMEPATH%\Mh24922J48114\U22815O81591.LXG
  • %HOMEPATH%\Mh24922J48114\87725.QUO
  • %HOMEPATH%\Mh24922J48114\W17458Z97479.ZAY
  • %HOMEPATH%\Mh24922J48114\V2287C63501.DIG
  • %HOMEPATH%\Mh24922J48114\I97785Z1490.LGW
  • %HOMEPATH%\Mh24922J48114\O68636R76571.JHB
  • %HOMEPATH%\Mh24922J48114\J92266F82231.TVJ
  • %HOMEPATH%\Mh24922J48114\98632.JQQ
  • %HOMEPATH%\Mh24922J48114\V56005I6263.MSY
  • %HOMEPATH%\Mh24922J48114\32006.CPG
  • %HOMEPATH%\Mh24922J48114\90319.IPD
  • %HOMEPATH%\Mh24922J48114\H65766O63161.JHK
  • %HOMEPATH%\Mh24922J48114\99298.FYN
  • %HOMEPATH%\Mh24922J48114\41730.UJT
  • %HOMEPATH%\Mh24922J48114\X73306S35691.MQZ
  • %HOMEPATH%\Mh24922J48114\94742.GBN
  • %HOMEPATH%\Mh24922J48114\43926.QNZ
  • %HOMEPATH%\Mh24922J48114\G8714G21199.CKQ
  • %HOMEPATH%\Mh24922J48114\49667.KGY
  • %HOMEPATH%\Mh24922J48114\68781.YIN
  • %HOMEPATH%\Mh24922J48114\17477.UXZ
  • %HOMEPATH%\Mh24922J48114\R38656Z22852.NHG
  • %HOMEPATH%\Mh24922J48114\H84624I59961.NSL
  • %HOMEPATH%\Mh24922J48114\R42577H9017.YPH
  • %HOMEPATH%\Mh24922J48114\A59644K97066.XCF
  • %HOMEPATH%\Mh24922J48114\74135.NNB
  • %HOMEPATH%\Mh24922J48114\83207.KHS
  • %HOMEPATH%\Mh24922J48114\38591.JIE
  • %HOMEPATH%\Mh24922J48114\N14342B10591.HOT
  • %HOMEPATH%\Mh24922J48114\41779.UOF
  • %HOMEPATH%\Mh24922J48114\56312.AQN
  • %HOMEPATH%\Mh24922J48114\52924.ULK
  • %HOMEPATH%\Mh24922J48114\Q19369U75481.VDN
  • %HOMEPATH%\Mh24922J48114\E60923A24639.LNX
  • %HOMEPATH%\Mh24922J48114\75650.NOY
  • %HOMEPATH%\Mh24922J48114\A76687A89634.RBD
  • %HOMEPATH%\Mh24922J48114\60448.BHD
  • %HOMEPATH%\Mh24922J48114\93362.XWS
  • %HOMEPATH%\Mh24922J48114\45298.FAF
  • %HOMEPATH%\Mh24922J48114\B80659Q60537.UBX
  • %HOMEPATH%\Mh24922J48114\19256.EZK
  • %HOMEPATH%\Mh24922J48114\J39739H3493.DXT
  • %HOMEPATH%\Mh24922J48114\28562.FKO
  • %HOMEPATH%\Mh24922J48114\86838.FDE
  • %HOMEPATH%\Mh24922J48114\95272.PJU
  • %HOMEPATH%\Mh24922J48114\R80864L6810.FGN
  • %HOMEPATH%\Mh24922J48114\D47610R58048.WVH
  • %HOMEPATH%\Mh24922J48114\T22141P27193.OXI
  • %HOMEPATH%\Mh24922J48114\hackdee.exe
  • %HOMEPATH%\Mh24922J48114\C61527Q24729.EAP
  • %HOMEPATH%\Mh24922J48114\V75834L66344.COM
  • %HOMEPATH%\Mh24922J48114\Y7266Z7374.HDD
  • %HOMEPATH%\Mh24922J48114\O2666X24670.GLB
  • %HOMEPATH%\Mh24922J48114\R92467S73593.WYK
  • %HOMEPATH%\Mh24922J48114\E78864E99777.KNC
  • %HOMEPATH%\Mh24922J48114\R90631R63639.FWB
  • %HOMEPATH%\Mh24922J48114\X1854Z12720.YRA
  • %HOMEPATH%\Mh24922J48114\D95539N34050.EDN
  • %HOMEPATH%\Mh24922J48114\21021.HPN
  • %HOMEPATH%\Mh24922J48114\87438.GDV
  • %HOMEPATH%\Mh24922J48114\75466.TLI
  • %HOMEPATH%\Mh24922J48114\56066.VPG
  • %HOMEPATH%\Mh24922J48114\V29631G44648.KUT
  • %HOMEPATH%\Mh24922J48114\W73250V17085.IUV
  • %HOMEPATH%\Mh24922J48114\W22922W59147.GEY
  • %HOMEPATH%\Mh24922J48114\17662.WSD
  • %HOMEPATH%\Mh24922J48114\56371.XAG
  • %HOMEPATH%\Mh24922J48114\4951.TJY
  • %HOMEPATH%\Mh24922J48114\H75413P22145.CZD
  • %HOMEPATH%\Mh24922J48114\10953.VNA
  • %HOMEPATH%\Mh24922J48114\W93968M83806.OGM
  • %HOMEPATH%\Mh24922J48114\39254.XXR
  • %HOMEPATH%\Mh24922J48114\23395.CGX
  • %HOMEPATH%\Mh24922J48114\O17798G78878.SUC
  • %HOMEPATH%\Mh24922J48114\52677.IET
  • %HOMEPATH%\Mh24922J48114\8276.EDW
  • %HOMEPATH%\Mh24922J48114\Y35119H22670.RBD
  • %HOMEPATH%\Mh24922J48114\S93672H6934.AQS
  • %HOMEPATH%\Mh24922J48114\V8924L86991.AIA
  • %HOMEPATH%\Mh24922J48114\95824.HCD
  • %HOMEPATH%\Mh24922J48114\F82764A77632.DGM
  • %HOMEPATH%\Mh24922J48114\69743.AIS
  • %HOMEPATH%\Mh24922J48114\9009.DRI
  • %HOMEPATH%\Mh24922J48114\G97360J80183.VTZ
  • %HOMEPATH%\Mh24922J48114\F32821R90793.PPM
  • %HOMEPATH%\Mh24922J48114\P19941Z74935.NQA
  • %HOMEPATH%\Mh24922J48114\D56632X89815.DDY
  • %HOMEPATH%\Mh24922J48114\88470.ZSD
  • %HOMEPATH%\Mh24922J48114\I43983H48822.XPF
  • %HOMEPATH%\Mh24922J48114\34416.MAT
  • %HOMEPATH%\Mh24922J48114\I15536T88035.LSQ
  • %HOMEPATH%\Mh24922J48114\Y85683N54121.WNX
  • %HOMEPATH%\Mh24922J48114\X9742Z85535.SRS
  • %HOMEPATH%\Mh24922J48114\M38265Q3544.FJW
  • %HOMEPATH%\Mh24922J48114\70223.LZJ
  • %HOMEPATH%\Mh24922J48114\85926.RMA
  • %HOMEPATH%\Mh24922J48114\75031.DYR
  • %HOMEPATH%\Mh24922J48114\C98180R33760.IJZ
  • %HOMEPATH%\Mh24922J48114\O86597A63705.SCU
  • %HOMEPATH%\Mh24922J48114\I51981L46029.HYP
  • %HOMEPATH%\Mh24922J48114\75567.NRA
  • %HOMEPATH%\Mh24922J48114\S10854X6449.LAN
  • %HOMEPATH%\Mh24922J48114\2505.RYG
  • %HOMEPATH%\Mh24922J48114\55591.HDG
  • %HOMEPATH%\Mh24922J48114\84114.CCY
  • %HOMEPATH%\Mh24922J48114\M36787P92293.MXQ
  • %HOMEPATH%\Mh24922J48114\A22238V26579.HTV
  • %HOMEPATH%\Mh24922J48114\7596.GWS
  • %HOMEPATH%\Mh24922J48114\41521.AIY
  • %HOMEPATH%\Mh24922J48114\W38755A56417.THZ
  • %HOMEPATH%\Mh24922J48114\55809.NNV
  • %HOMEPATH%\Mh24922J48114\24198.EXY
  • %HOMEPATH%\Mh24922J48114\2660.AGS
  • %HOMEPATH%\Mh24922J48114\H20828S97133.FRM
  • %HOMEPATH%\Mh24922J48114\U92253R19327.BEG
  • %HOMEPATH%\Mh24922J48114\31359.SKE
  • %HOMEPATH%\Mh24922J48114\E78396Y24146.ZWZ
  • %HOMEPATH%\Mh24922J48114\13890.DWZ
  • %HOMEPATH%\Mh24922J48114\V76194T51249.XPU
  • %HOMEPATH%\Mh24922J48114\66135.QOC
  • %HOMEPATH%\Mh24922J48114\O6224T46813.XFY
  • %HOMEPATH%\Mh24922J48114\I34866X1917.AEA
  • %HOMEPATH%\Mh24922J48114\M54149F86272.YPC
  • %HOMEPATH%\Mh24922J48114\S76804N98366.HER
  • %HOMEPATH%\Mh24922J48114\92901.IMK
  • %HOMEPATH%\Mh24922J48114\28058.NAA
  • %HOMEPATH%\Mh24922J48114\11218.AVC
  • %HOMEPATH%\Mh24922J48114\A92108H48838.DRN
  • %HOMEPATH%\Mh24922J48114\64116.KIA
  • %HOMEPATH%\Mh24922J48114\61736.IVA
  • %HOMEPATH%\Mh24922J48114\P21467E67052.ZEC
  • %HOMEPATH%\Mh24922J48114\U92971R56835.CQH
  • %HOMEPATH%\Mh24922J48114\U93374T1143.QVG
  • %HOMEPATH%\Mh24922J48114\88483.JBC
  • %HOMEPATH%\Mh24922J48114\13901.COF
  • %HOMEPATH%\Mh24922J48114\A32459U99318.ALB
  • %HOMEPATH%\Mh24922J48114\37580.VRX
  • %HOMEPATH%\Mh24922J48114\U79054V64998.WRP
  • %HOMEPATH%\Mh24922J48114\L66331Y91523.KIS
  • %HOMEPATH%\Mh24922J48114\98703.ETO
  • %HOMEPATH%\Mh24922J48114\71097.WCQ
  • %HOMEPATH%\Mh24922J48114\O18817K51559.NQV
  • %HOMEPATH%\Mh24922J48114\H39296M94737.ABK
  • %HOMEPATH%\Mh24922J48114\G74369U89943.ASK
  • %HOMEPATH%\Mh24922J48114\Y20516N93034.FGO
  • %HOMEPATH%\Mh24922J48114\12025.RBQ
  • %HOMEPATH%\Mh24922J48114\K88799N6860.WIS
  • %HOMEPATH%\Mh24922J48114\78276.ZBD
  • %HOMEPATH%\Mh24922J48114\G70549Q5696.OCL
  • %HOMEPATH%\Mh24922J48114\K37583M22398.TOK
  • %HOMEPATH%\Mh24922J48114\H22517A66110.CMD
  • %HOMEPATH%\Mh24922J48114\H42529Y81710.DXC
  • %HOMEPATH%\Mh24922J48114\14055.OGS
  • %HOMEPATH%\Mh24922J48114\4867.WXP
  • %HOMEPATH%\Mh24922J48114\R59800O3671.PAV
  • %HOMEPATH%\Mh24922J48114\Y68917B75222.UOR
  • %HOMEPATH%\Mh24922J48114\I15472D77635.YZT
  • %HOMEPATH%\Mh24922J48114\49512.PCL
  • %HOMEPATH%\Mh24922J48114\55121.IYG
  • %HOMEPATH%\Mh24922J48114\42534.WHW
  • %HOMEPATH%\Mh24922J48114\J72331P10347.ZBU
  • %HOMEPATH%\Mh24922J48114\S92853E50981.FNT
  • %HOMEPATH%\Mh24922J48114\59894.MES
  • %HOMEPATH%\Mh24922J48114\L61107G85667.EOS
  • %HOMEPATH%\Mh24922J48114\B73854S10714.GXM
  • %HOMEPATH%\Mh24922J48114\81697.NVL
  • %HOMEPATH%\Mh24922J48114\93235.SBS
  • %HOMEPATH%\Mh24922J48114\I37933Q75784.RPS
  • %HOMEPATH%\Mh24922J48114\L38524P28045.PLV
  • %HOMEPATH%\Mh24922J48114\97516.DPV
  • %HOMEPATH%\Mh24922J48114\37017.VMG
  • %HOMEPATH%\Mh24922J48114\B15575Z16910.DRN
  • %HOMEPATH%\Mh24922J48114\B71945T35671.KTK
  • %HOMEPATH%\Mh24922J48114\N13513S31956.IBD
  • %HOMEPATH%\Mh24922J48114\8326.PUJ
  • %HOMEPATH%\Mh24922J48114\52724.PLI
  • %HOMEPATH%\Mh24922J48114\R15916E16658.UDB
  • %HOMEPATH%\Mh24922J48114\E83382P59266.YKR
  • %HOMEPATH%\Mh24922J48114\Y47909R89713.JTQ
  • %HOMEPATH%\Mh24922J48114\80293.VQJ
  • %HOMEPATH%\Mh24922J48114\A5738T87216.SKV
  • %HOMEPATH%\Mh24922J48114\99353.QQT
  • %HOMEPATH%\Mh24922J48114\95628.SMH
  • %HOMEPATH%\Mh24922J48114\P32325M4055.DVZ
  • %HOMEPATH%\Mh24922J48114\58742.QIH
  • %HOMEPATH%\Mh24922J48114\E40081A11817.IPD
  • %HOMEPATH%\Mh24922J48114\S54889O81426.DMK
  • %HOMEPATH%\Mh24922J48114\D58944E45343.BNV
  • %HOMEPATH%\Mh24922J48114\99651.JRD
  • %HOMEPATH%\Mh24922J48114\75940.FAU
  • %HOMEPATH%\Mh24922J48114\G91141E95758.RWD
  • %HOMEPATH%\Mh24922J48114\C26298A26688.XLJ
  • %HOMEPATH%\Mh24922J48114\R74041D77755.FJA
  • %HOMEPATH%\Mh24922J48114\V82929W34476.CBR
  • %HOMEPATH%\Mh24922J48114\24041.UXW
  • %HOMEPATH%\Mh24922J48114\61352.RLB
  • %HOMEPATH%\Mh24922J48114\V64364P3732.YKY
  • %HOMEPATH%\Mh24922J48114\E64091I19019.XUF
  • %HOMEPATH%\Mh24922J48114\I95159N82791.DJB
  • %HOMEPATH%\Mh24922J48114\95725.DVM
  • %HOMEPATH%\Mh24922J48114\86010.VLK
  • %HOMEPATH%\Mh24922J48114\T44518R84997.MSN
  • %HOMEPATH%\Mh24922J48114\24234.FNO
  • %HOMEPATH%\Mh24922J48114\90891.LMW
  • %HOMEPATH%\Mh24922J48114\95262.NYD
  • %HOMEPATH%\Mh24922J48114\71397.GNR
  • %HOMEPATH%\Mh24922J48114\63559.AOV
  • %HOMEPATH%\Mh24922J48114\H25095F96227.VBQ
  • %HOMEPATH%\Mh24922J48114\Y64188N30533.FVX
  • %HOMEPATH%\Mh24922J48114\R75127C34790.QLX
  • %HOMEPATH%\Mh24922J48114\8002.DUW
  • %HOMEPATH%\Mh24922J48114\Q74311I33765.DVE
  • %HOMEPATH%\Mh24922J48114\2969.JAH
  • %HOMEPATH%\Mh24922J48114\B58974Z88132.HMK
  • %HOMEPATH%\Mh24922J48114\5629.DVG
  • %HOMEPATH%\Mh24922J48114\B6579G63178.SUU
  • %HOMEPATH%\Mh24922J48114\D49444O13811.USD
  • %HOMEPATH%\Mh24922J48114\H60453D73109.KUM
  • %HOMEPATH%\Mh24922J48114\31310.SVA
  • %HOMEPATH%\Mh24922J48114\Y10252J36922.YMT
  • %HOMEPATH%\Mh24922J48114\D81590B71680.IIN
  • %HOMEPATH%\Mh24922J48114\73873.YXE
  • %HOMEPATH%\Mh24922J48114\Z59474Y13717.NNB
  • %HOMEPATH%\Mh24922J48114\17472.MPS
  • %HOMEPATH%\Mh24922J48114\Z44353R69321.OVW
  • %HOMEPATH%\Mh24922J48114\W20402M70760.UNO
  • %HOMEPATH%\Mh24922J48114\71559.PPQ
  • %HOMEPATH%\Mh24922J48114\V42239E43371.JBK
  • %HOMEPATH%\Mh24922J48114\63211.EWV
  • %HOMEPATH%\Mh24922J48114\K18852L17704.YWJ
  • %HOMEPATH%\Mh24922J48114\K63144T99070.CST
  • %HOMEPATH%\Mh24922J48114\B22154W5360.ILD
  • %HOMEPATH%\Mh24922J48114\62903.JSV
  • %HOMEPATH%\Mh24922J48114\19931.TQJ
  • %HOMEPATH%\Mh24922J48114\D84936R26583.NIL
  • %HOMEPATH%\Mh24922J48114\Z46702T53255.QMW
  • %HOMEPATH%\Mh24922J48114\I34933N60352.IHX
  • %HOMEPATH%\Mh24922J48114\30309.SOI
  • %HOMEPATH%\Mh24922J48114\43211.QQS
  • %HOMEPATH%\Mh24922J48114\3829.DYU
  • %HOMEPATH%\Mh24922J48114\K99442Q82826.TVN
  • %HOMEPATH%\Mh24922J48114\N86113V37864.OPZ
  • %HOMEPATH%\Mh24922J48114\12088.AEZ
  • %HOMEPATH%\Mh24922J48114\78651.FJO
  • %HOMEPATH%\Mh24922J48114\Q65031J72184.NNY
  • %HOMEPATH%\Mh24922J48114\93861.ATM
  • %HOMEPATH%\Mh24922J48114\U38638S95076.KSE
  • %HOMEPATH%\Mh24922J48114\Q29314J66998.OSA
  • %HOMEPATH%\Mh24922J48114\T98854G37408.LPX
Sets the 'hidden' attribute to the following files:
  • %HOMEPATH%\Mv50307Y41999.WG2
Deletes the following files:
  • %TEMP%\aut1.tmp
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Shell_TrayWnd' WindowName: '(null)'
  • ClassName: 'EDIT' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android