Trojan.DownLoader5.54650

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%HOMEPATH%\UpBackup\UpdateOffice.exe

Malicious functions:

Creates and executes the following:

%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\UpBackup\UpdateOffice.exe

Executes the following:

<SYSTEM32>\ping.exe www.ma##kil.in
<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\pangtip.bat" "
<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\100.bat" "

Modifies file system :

Creates the following files:

%HOMEPATH%\PrintHood\nc9IKRhSNQ.PRI
%HOMEPATH%\PrintHood\uImQ2a97na.PRI
%HOMEPATH%\PrintHood\~EnWTSYfjeBa7St6cN5oQ.TMP
%HOMEPATH%\PrintHood\~eyj4r3QkKaCCGR0ccWaP.TMP
%HOMEPATH%\PrintHood\mJlPVzVmHE.PRI
%HOMEPATH%\PrintHood\Zp0P0ez5sy.PRI
%HOMEPATH%\PrintHood\rH7s8AJqQE.PRI
%HOMEPATH%\PrintHood\3TWQqMB36P.PRI
%HOMEPATH%\PrintHood\2Lj6RF5YBP.PRI
%HOMEPATH%\PrintHood\~gUQF01VA0DwyGDgUX7yi.TMP
%HOMEPATH%\PrintHood\~x5nIENoJSALW5ixbMoXy.TMP
%HOMEPATH%\PrintHood\~c7NIdKJuM9FE6yezs952.TMP
%HOMEPATH%\PrintHood\~6eXqP6adOMOR1PXkA4Cn.TMP
%HOMEPATH%\PrintHood\~v7jHuPis3hlYGSnnIaJ8.TMP
%HOMEPATH%\PrintHood\~EHYeeveFroHRCE3lBmTk.TMP
%HOMEPATH%\PrintHood\~bf9GN87KRg15UNiby70g.TMP
%HOMEPATH%\PrintHood\~MgAdBxfHllkt9sUgaHaF.TMP
%HOMEPATH%\PrintHood\~UnR8YMgshn0Y2EUEk45C.TMP
%HOMEPATH%\PrintHood\~biSNoJsWSh10zOaF9lON.TMP
%HOMEPATH%\PrintHood\AWzsGBhNLO.PRI
%HOMEPATH%\PrintHood\tZ1VNebVfn.PRI
%HOMEPATH%\PrintHood\S58eDFG8pi.PRI
%HOMEPATH%\PrintHood\DYGub6npUh.PRI
%HOMEPATH%\PrintHood\aHcACMySAF.PRI
%HOMEPATH%\PrintHood\8CDH9q1ues.PRI
%HOMEPATH%\PrintHood\lCCyajPnpq.PRI
%HOMEPATH%\PrintHood\DC2IiDpaVw.PRI
%HOMEPATH%\PrintHood\IhcC61WtAq.PRI
%HOMEPATH%\PrintHood\eNZoa5Qcps.PRI
%HOMEPATH%\PrintHood\j9IUsryVWU.PRI
%HOMEPATH%\PrintHood\42sJXLAiJ4.PRI
%HOMEPATH%\PrintHood\FQVlo7wrVV.PRI
%HOMEPATH%\PrintHood\uMyuSpX9GI.PRI
%HOMEPATH%\PrintHood\wzSpRfMxsF.PRI
%HOMEPATH%\PrintHood\nyOSkTXH1S.PRI
%HOMEPATH%\PrintHood\0Rvz0Jnrri.PRI
%HOMEPATH%\PrintHood\TkSgUvygUI.PRI
%HOMEPATH%\PrintHood\V2ZIDDXzyK.PRI
%HOMEPATH%\PrintHood\rKNJvAIAlO.PRI
%HOMEPATH%\PrintHood\~lRcMlKBBGuJaid8iTETy.TMP
%HOMEPATH%\PrintHood\~qco50k6BBwIf37KnrcAI.TMP
%HOMEPATH%\PrintHood\~YkUeVUNJJF5c4RZJw7F7.TMP
%HOMEPATH%\PrintHood\~MzwV0Zqz5ba61YMIhSVx.TMP
%HOMEPATH%\PrintHood\~UaX7u1Uw99GExJPoTA2p.TMP
%HOMEPATH%\PrintHood\~DMhjjPeY1HJP2s1GKJy8.TMP
%HOMEPATH%\PrintHood\~rgJokxEoeDghuXbfpPV3.TMP
%HOMEPATH%\PrintHood\~4EIPFaHdgfRGp695MGI3.TMP
%HOMEPATH%\PrintHood\~bxTabhpNc6dgbpOEXqC6.TMP
%HOMEPATH%\PrintHood\~gcOBNTrs6INnRm6FLoB8.TMP
%HOMEPATH%\PrintHood\~z1v4IXMsCcXxpWtOnpIc.TMP
%HOMEPATH%\PrintHood\~rdcmIMGWbfJm33fmA1rE.TMP
%HOMEPATH%\PrintHood\~C6URxhhtz4ROTSnCYYp3.TMP
%HOMEPATH%\PrintHood\~MTkU8YiltoxVmxSmHZJw.TMP
%HOMEPATH%\PrintHood\~QxMmI1RtoT0rRz0ycDVE.TMP
%HOMEPATH%\PrintHood\~wAtdMI2qzbGt66OuBEtD.TMP
%HOMEPATH%\PrintHood\~dQNF26FSwcssfW7s4s2h.TMP
%HOMEPATH%\PrintHood\~VX6nMlGgroE2aiJ8U4kg.TMP
%HOMEPATH%\PrintHood\~mZjOoRyrSFanrn0HelvS.TMP
%HOMEPATH%\PrintHood\~BRzwdx0huhJAbov7sFZy.TMP
%HOMEPATH%\PrintHood\~6CvoEKyPuzeSSkrjE5Pq.TMP
%HOMEPATH%\PrintHood\~q7jgJYD98YPoj5owysKW.TMP
%HOMEPATH%\PrintHood\~Ak4oAuNhgbm8nhNtqbkj.TMP
%HOMEPATH%\PrintHood\~fLLmuJeEc3HsvGZVaCrv.TMP
%HOMEPATH%\PrintHood\~Pe8BLnB16YFNSi1lf7Jt.TMP
%HOMEPATH%\PrintHood\~sbfyWAVh8ZmWpYQK8p6k.TMP
%HOMEPATH%\PrintHood\~pxOUFG4BdRIvmQuQnV4r.TMP
%HOMEPATH%\PrintHood\~D6Kqfkg5HnSsVMWLbQ0p.TMP
%HOMEPATH%\PrintHood\~HYh6h03HlhIRRZHW5WRw.TMP
%HOMEPATH%\PrintHood\~Qu5TVhrAJW2jIDq0Hm83.TMP
%HOMEPATH%\PrintHood\~o3UWFoBmUtDzx62Ul4H4.TMP
%HOMEPATH%\PrintHood\~M9pvKQ3OzOnO6vIGn3nt.TMP
%HOMEPATH%\PrintHood\~4dUbqykcpVC3rB9wsijR.TMP
%HOMEPATH%\PrintHood\~Zbt9rVwb9Vslj3lFiDRL.TMP
%HOMEPATH%\PrintHood\~7QV0AfKdjFXinEiha9QK.TMP
%HOMEPATH%\PrintHood\~VPkutRodyTyxLc1NGfyJ.TMP
%HOMEPATH%\PrintHood\~R7AkzYV1YDV4kMtJo4WH.TMP
%HOMEPATH%\PrintHood\~JrnUw098709le5ndThCn.TMP
%HOMEPATH%\PrintHood\~pZiuvJOU14gHgpiI88OS.TMP
%HOMEPATH%\PrintHood\4BotUIWP8i.dll
%HOMEPATH%\PrintHood\qEBNIFjWiX.dll
%HOMEPATH%\PrintHood\3xr2fYc6SN.dll
%HOMEPATH%\PrintHood\9GZYdNoILL.dll
%HOMEPATH%\PrintHood\86nGDm9lVu.dll
%HOMEPATH%\PrintHood\5nz3hPR1fB.dll
%HOMEPATH%\PrintHood\4NBDhv8AC1.dll
%HOMEPATH%\PrintHood\BoF6f4CUid.dll
%HOMEPATH%\PrintHood\nRoDqvweBf.dll
%HOMEPATH%\PrintHood\IWOHGvQxm1.dll
%HOMEPATH%\PrintHood\FWnuRsrxc8.dll
%HOMEPATH%\PrintHood\TrTlDx2AR8.dll
%HOMEPATH%\PrintHood\nI3QOxDMWB.dll
%HOMEPATH%\PrintHood\K71T4lM0kj.dll
%HOMEPATH%\PrintHood\d1CGAYChAI.dll
%HOMEPATH%\PrintHood\x6chsIMjxM.dll
%HOMEPATH%\PrintHood\YQU6pVBM2s.dll
%HOMEPATH%\PrintHood\XupeX0cLIf.dll
%HOMEPATH%\PrintHood\kTuJ7hW2i1.dll
%HOMEPATH%\PrintHood\TTnAhxHsbn.dll
%HOMEPATH%\PrintHood\ebyrNjbr3O.dll
%HOMEPATH%\PrintHood\RLorQcNPJm.dll
%HOMEPATH%\PrintHood\zeXYVtkWdn.dll
%HOMEPATH%\PrintHood\YVGtkM37XR.dll
%HOMEPATH%\PrintHood\GUoIIaOp1S.dll
%HOMEPATH%\PrintHood\pangtip.bat
%HOMEPATH%\PrintHood\UPDATE~1.EXE.pkxm
%HOMEPATH%\PrintHood\sRxmK7eLXc.dll
%HOMEPATH%\Templates\nam.dll
%HOMEPATH%\PrintHood\LRz7QOhcUb.dll
%HOMEPATH%\PrintHood\bVyeYXpgCp.dll
%HOMEPATH%\PrintHood\SfMAqbbJf0.dll
%HOMEPATH%\PrintHood\DCtKni2R00.dll
%HOMEPATH%\PrintHood\hClRM4sKBm.dll
%HOMEPATH%\PrintHood\TK7CRsnS1n.dll
%HOMEPATH%\PrintHood\xlV2A5xk1F.dll
%HOMEPATH%\PrintHood\pdXDSqRgLe.dll
%HOMEPATH%\PrintHood\5P97NBqmtC.dll
%HOMEPATH%\PrintHood\ArUL77UtEu.dll
%HOMEPATH%\PrintHood\mWXHXAm7QC.PRI
%HOMEPATH%\PrintHood\y8jY4x2PIm.PRI
%HOMEPATH%\PrintHood\uw2PLg66qa.PRI
%HOMEPATH%\PrintHood\CbT3rOLLbv.PRI
%HOMEPATH%\PrintHood\2XEWoXKyhb.PRI
%HOMEPATH%\PrintHood\ynpmJ9QLz3.PRI
%HOMEPATH%\PrintHood\pgyZbYQ4Eu.PRI
%HOMEPATH%\PrintHood\M8dS3asMos.PRI
%HOMEPATH%\PrintHood\0vsf7QjoOI.PRI
%HOMEPATH%\PrintHood\ukXm6GEXUT.PRI
%HOMEPATH%\PrintHood\mhRBA36ZCA.PRI
%HOMEPATH%\PrintHood\lOhnPN2WLS.PRI
%HOMEPATH%\PrintHood\sXAPdocEEi.PRI
%HOMEPATH%\PrintHood\j0r8DKMF6g.PRI
%HOMEPATH%\PrintHood\m1yWqIHII5.PRI
%HOMEPATH%\PrintHood\IiY6pliChE.PRI
%HOMEPATH%\PrintHood\subhSPEg2t.PRI
%HOMEPATH%\PrintHood\dcXO7PbqrD.PRI
%HOMEPATH%\PrintHood\7f3tJHEeQq.PRI
%HOMEPATH%\PrintHood\PZMMmknkMG.PRI
%HOMEPATH%\PrintHood\1UWKhuoEJd.dll
%HOMEPATH%\PrintHood\NRGCGpiVWD.dll
%HOMEPATH%\PrintHood\5zNuMvTNNR.dll
%HOMEPATH%\PrintHood\aFcMBbIi3d.dll
%HOMEPATH%\PrintHood\jnemhkTQX0.dll
%HOMEPATH%\PrintHood\sjPB5amJOD.dll
%HOMEPATH%\PrintHood\QfUhwZRPS2.dll
%HOMEPATH%\PrintHood\EDa2br1gXu.dll
%HOMEPATH%\PrintHood\CZCoaCUOS1.dll
%HOMEPATH%\PrintHood\mOaslpbmB1.dll
%HOMEPATH%\PrintHood\1ynPW8ANSs.PRI
%HOMEPATH%\PrintHood\e3QQwduxkk.PRI
%HOMEPATH%\PrintHood\EaFzdlSC86.PRI
%HOMEPATH%\PrintHood\FwboD30u7p.PRI
%HOMEPATH%\PrintHood\R2aRaUt5R2.dll
%HOMEPATH%\PrintHood\xf7tvqIuNW.dll
%HOMEPATH%\PrintHood\nY28t6AP83.dll
%HOMEPATH%\PrintHood\mp4Ms3KlD9.dll
%HOMEPATH%\PrintHood\oGPNOqC2Gr.dll
%HOMEPATH%\PrintHood\~4UjZz5RhHhdaArvzVnsb.TMP
%HOMEPATH%\PrintHood\~tTwgBuFaJEqVCLtVfs2O.TMP
%HOMEPATH%\PrintHood\~J9INITNvjHpqaMzYzw5c.TMP
%HOMEPATH%\PrintHood\~Pg9VMG7jQ84TG84GagL8.TMP
%HOMEPATH%\PrintHood\~oxvpU3bCnSK7CgKJgqh3.TMP
%HOMEPATH%\PrintHood\~SyQpdv81sOY26KhdYKFy.TMP
%HOMEPATH%\PrintHood\~I5fyQfDoeX37nudbzly6.TMP
%HOMEPATH%\PrintHood\~CzdLHMeZ87p2J0hg06CT.TMP
%HOMEPATH%\PrintHood\~ADd4ZYxFzyFoOkvtKTaB.TMP
%HOMEPATH%\PrintHood\~vePYEUkq4I8Fij0k7MXt.TMP
%HOMEPATH%\PrintHood\~4g4bMMQUPPJ44JqsrmD0.TMP
%HOMEPATH%\PrintHood\~cCyxJ3xcNTuxxbSOwqx8.TMP
%HOMEPATH%\PrintHood\~fOFdPl7FeJhJ1DWzcvah.TMP
%HOMEPATH%\PrintHood\~MaInqd4UgKQzmEIK6pVz.TMP
%HOMEPATH%\PrintHood\~zp7XR8BpLpPsu5YyRAs2.TMP
%HOMEPATH%\PrintHood\~Eq22CEyNAFN5ONsjUNBU.TMP
%HOMEPATH%\PrintHood\~oCMIKShNmTr90TudG5IP.TMP
%HOMEPATH%\PrintHood\~b9XnXeueSVmRSPCG0YFR.TMP
%HOMEPATH%\PrintHood\~BfwgQNsoQbUceqbF1LUQ.TMP
%HOMEPATH%\PrintHood\~9eJU3PRctHOWKweABZbD.TMP
%HOMEPATH%\PrintHood\~1zPTMY1l7KbKD0GEjRmU.TMP
%HOMEPATH%\PrintHood\~0rNiJbIUEIK0suWyJTDl.TMP
%HOMEPATH%\PrintHood\~HVYFSykMMd7IL4O8GOHl.TMP
%HOMEPATH%\PrintHood\~LLMdTpaj18bDXL82erlz.TMP
%HOMEPATH%\PrintHood\~Q3psoUWRtuKnMRNjzs8t.TMP
%HOMEPATH%\PrintHood\~xaMtIp4YKZgT6nl1pkgx.TMP
%HOMEPATH%\PrintHood\~NVR7E29N5wjLyaY4PgW4.TMP
%HOMEPATH%\PrintHood\~dYWuTQwRGMrejKDIi4EH.TMP
%HOMEPATH%\PrintHood\~ccjuz5YnNKWuYA5KulS0.TMP
%HOMEPATH%\PrintHood\~wKn7qgw9psH9FmDz8AlQ.TMP
%HOMEPATH%\PrintHood\~B7SXDCZF8yQoN1rxL4wM.TMP
%HOMEPATH%\PrintHood\~JdxfYgUDKQ80ih4WZ5nS.TMP
%HOMEPATH%\PrintHood\~pexux8K30pNlpz51Xiko.TMP
%HOMEPATH%\PrintHood\~NEOvHMbyJ2gO6Vwh4Oar.TMP
%HOMEPATH%\PrintHood\~BbwAQFkoV8wh3s6FkvT6.TMP
%HOMEPATH%\PrintHood\~mFknHh4XwOFB6H31ZwU8.TMP
%HOMEPATH%\PrintHood\~aU3bgKDtaTFSefCyfnLT.TMP
%HOMEPATH%\PrintHood\~EXTzl6BZY0xMDyWQJxOT.TMP
%HOMEPATH%\PrintHood\~ImUAtj6I84o1M1rE2V7z.TMP
%HOMEPATH%\PrintHood\~W3p13Hhyxb2nStoIn2BG.TMP
%HOMEPATH%\PrintHood\~4CrAhR1WWbmxj4qdfH5Z.TMP
%HOMEPATH%\PrintHood\~miKo9StUPvOTZ2UsyHnT.TMP
%HOMEPATH%\PrintHood\~O7TtqRSwvqXJBjRNzWzT.TMP
%HOMEPATH%\PrintHood\~phC0b2Hvfb5X2IWUOjdH.TMP
%HOMEPATH%\PrintHood\~809CDfPMtX3gBr8F92pw.TMP
%HOMEPATH%\PrintHood\~gFKHCyoPDXJYezTQXPFG.TMP
%HOMEPATH%\PrintHood\~cnkq6Uc9UYYPF4Y0RkEX.TMP
%HOMEPATH%\PrintHood\~foN3tmsBq71sfaNhlFUh.TMP
%HOMEPATH%\PrintHood\~den8eQXa95pEijnOc7RD.TMP
%HOMEPATH%\PrintHood\<Virus name>.exe.docx
%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\PrintHood\mahdi.txt
%HOMEPATH%\PrintHood\<Virus name>.exe.txt
%HOMEPATH%\PrintHood\100.bat
%HOMEPATH%\PrintHood\~T21xIZUOruLgHkDyfjv1.TMP
%HOMEPATH%\PrintHood\~TWDXdYwnLzflTyGgzZ5B.TMP
%HOMEPATH%\PrintHood\xdat.dll
%HOMEPATH%\PrintHood\~cI70nImG0fkHrFZV5gVS.TMP
%HOMEPATH%\PrintHood\~uEfjAlBKv5cR5vnqvKX9.TMP
%HOMEPATH%\PrintHood\~J7dC5V5jt2xPxaRN9y1H.TMP
%HOMEPATH%\PrintHood\~3YR54Q7jq2Y7cnVUAQMK.TMP
%HOMEPATH%\PrintHood\~6RStCfhIwHdDE5XoiXhO.TMP
%HOMEPATH%\PrintHood\~ohDFviv33VFQ3ATLG2UT.TMP
%HOMEPATH%\PrintHood\~VYEVFvmgec4UPrg95OhN.TMP
%HOMEPATH%\PrintHood\~rJyShVdMN9HLF5IBcFhh.TMP
%HOMEPATH%\PrintHood\~8tQUNcc3reOOjoxSZ2F5.TMP
%HOMEPATH%\PrintHood\~wJKQk7rl6k0rxFwdzGUX.TMP
%HOMEPATH%\PrintHood\~7sTqZQAbRNFb2xi1hVpu.TMP
%HOMEPATH%\PrintHood\~zhbzgZVCOlEgzyvQJumU.TMP
%HOMEPATH%\PrintHood\~DtkJZoytnKfXuKwrJIRK.TMP
%HOMEPATH%\PrintHood\~frLJfW3EhGAuHN5FjUZA.TMP
%HOMEPATH%\PrintHood\~Hfbu4BiQX6WcFh6RbClU.TMP
%HOMEPATH%\PrintHood\~y0yqAzOU6zdAtT2qnrWb.TMP
%HOMEPATH%\PrintHood\~0a6QqK8xBM8i8cJU65pR.TMP
%HOMEPATH%\PrintHood\~9q5WA2xtyySruVhGRem0.TMP
%HOMEPATH%\PrintHood\~yfV0XisSoD6qsESmjNua.TMP
%HOMEPATH%\PrintHood\~WgAvPlEdOcBOYQfiZEcw.TMP
%HOMEPATH%\PrintHood\~GCP2dewCG8KvqOYChajj.TMP
%HOMEPATH%\PrintHood\~Up4uqRtR87x8MGN2HnUp.TMP
%HOMEPATH%\PrintHood\~rGtrlbIp0Nhv1dpIx6VF.TMP
%HOMEPATH%\PrintHood\~LRUwojjgYt7IJQlr1y3n.TMP
%HOMEPATH%\PrintHood\~2B3AMhc72lK2UiTgDHaL.TMP
%HOMEPATH%\PrintHood\~aUQiY3KxRiQxwAjrfwJz.TMP
%HOMEPATH%\PrintHood\~FGXOlDnPOxUsnNRfGFGf.TMP
%HOMEPATH%\PrintHood\~5sdQfxDV7MSHqsKHkHHG.TMP
%HOMEPATH%\PrintHood\~0t4dtOfhBGSZMq6KcKgb.TMP
%HOMEPATH%\PrintHood\~15NlqzQp8Mb6JqogmZQo.TMP
%HOMEPATH%\PrintHood\~3l6fsjsI5qSN9mQpNgYd.TMP
%HOMEPATH%\PrintHood\~itSAF2kMmcl0wocn8HE4.TMP
%HOMEPATH%\PrintHood\~Lm3oQa67fTmhmi4DosoM.TMP
%HOMEPATH%\PrintHood\~C6GsFsLl6y6BrK7DV2mk.TMP
%HOMEPATH%\PrintHood\~4lEW6yMwgTslzd0TbLiO.TMP
%HOMEPATH%\PrintHood\~ZaI09GvCeyJaCMJw9tBL.TMP
%HOMEPATH%\PrintHood\~TCzPes9rPrvAWTFOiJZk.TMP
%HOMEPATH%\PrintHood\~3q8jzeE9q01isNBzkrNY.TMP
%HOMEPATH%\PrintHood\~3pxqWSjxKPHc2cmbJyGe.TMP
%HOMEPATH%\PrintHood\~OkwWlE4rlgklHSOVylDs.TMP
%HOMEPATH%\PrintHood\~EQSCHAijc53ALdwLOLs1.TMP
%HOMEPATH%\PrintHood\~gkNn97cLCgtomaVFbdbL.TMP
%HOMEPATH%\PrintHood\~VtmblcKv37smDNAQyki9.TMP
%HOMEPATH%\PrintHood\~phV2hwW1z4gfGJBo2tXn.TMP
%HOMEPATH%\PrintHood\~0P3Awo1RwnmPdykNPxMK.TMP
%HOMEPATH%\PrintHood\~UKlwN5U65z2rvnxqxNPe.TMP
%HOMEPATH%\PrintHood\~Goap9NYAnLXvJT5LMii3.TMP
%HOMEPATH%\PrintHood\~sUtMvROWdlHBKCeec8JB.TMP
%HOMEPATH%\PrintHood\~vp8J99C7e6dXxKKE5U0z.TMP
%HOMEPATH%\PrintHood\~ytnbgJGEYlNPoHSwf5Zj.TMP
%HOMEPATH%\PrintHood\~IYxhEY6nQR5Ll6cziKjz.TMP
%HOMEPATH%\PrintHood\~xuTj9INhIG1wLBL5Zs4j.TMP
%HOMEPATH%\PrintHood\~ixnU1GvK2OS0k4HNq0yy.TMP
%HOMEPATH%\PrintHood\~fA2qFKXIPGDBTDdvTxiz.TMP
%HOMEPATH%\PrintHood\~Smji0OVEZBEhhuN5kM6D.TMP
%HOMEPATH%\PrintHood\~22MifdHXZJNIEZaj5YjJ.TMP
%HOMEPATH%\PrintHood\~oyOMdEEoVqlF02Fqaky1.TMP
%HOMEPATH%\PrintHood\~ORQ0LvM9mscssBIZ1KKy.TMP
%HOMEPATH%\PrintHood\~xDPUqyeaqNhQExy4mmuI.TMP
%HOMEPATH%\PrintHood\~xILoXmqcBb8UWBN1Okou.TMP
%HOMEPATH%\PrintHood\~4362ptFwBQKoiJDEq6TO.TMP
%HOMEPATH%\PrintHood\~NyiYITQaUrQQ3Vy1kdBE.TMP
%HOMEPATH%\PrintHood\~3WpOq2RM9YC0MwxHM3HH.TMP
%HOMEPATH%\PrintHood\~iHa9k1xRpHmH6NhNepjP.TMP
%HOMEPATH%\PrintHood\~riI8Gj5AsTNfZhchjVDa.TMP
%HOMEPATH%\PrintHood\~jnLUQ5xEx0gJEjxy2cV5.TMP
%HOMEPATH%\PrintHood\~FGP2f8PV3HhLornGObx8.TMP
%HOMEPATH%\PrintHood\~G2FRr7rTyO7brP3QVbJV.TMP
%HOMEPATH%\PrintHood\~fuphIfhvCVGGzyDYw7w8.TMP
%HOMEPATH%\PrintHood\~gCBMygSH2JlEyHUcYpQg.TMP
%HOMEPATH%\PrintHood\~YwMeqkPobDQKhjVjEcra.TMP
%HOMEPATH%\PrintHood\~IfjwiRNtKddy4g2ODIrM.TMP
%HOMEPATH%\PrintHood\~wmUIbeM7jQEDwXvDqccc.TMP
%HOMEPATH%\PrintHood\~IXkrCjhbizpNYEWG1sE5.TMP
%HOMEPATH%\PrintHood\~aNCdla6FUNGiVJ3IjmYI.TMP
%HOMEPATH%\PrintHood\~dwXQBUuyi4wa7DeaPC2P.TMP
%HOMEPATH%\PrintHood\~oWUsnsUClBwPneEXMu8R.TMP
%HOMEPATH%\PrintHood\~h0SSSYRTcUNmgRNw4G4E.TMP
%HOMEPATH%\PrintHood\~JMEeB45B52x6LYcvqEKH.TMP
%HOMEPATH%\PrintHood\~1zrgFARUV6onCWtk0cmz.TMP
%HOMEPATH%\PrintHood\~T0dT4FxTSwvFHrD0x2qf.TMP
%HOMEPATH%\PrintHood\~DGxsjgkEIkBncKSABgye.TMP
%HOMEPATH%\PrintHood\~FmTUghvznZsrZMKU5Tvl.TMP
%HOMEPATH%\PrintHood\~4szt9vHrMgQNg5fcNJal.TMP
%HOMEPATH%\PrintHood\~QmpmvYdHnnlhRSYWnUCE.TMP
%HOMEPATH%\PrintHood\~lltmcLA15yaqBa4UAxhg.TMP
%HOMEPATH%\PrintHood\~bLEa4Yh9E1M9IXyHxqpB.TMP
%HOMEPATH%\PrintHood\~kMl2C66OZSHVb8KhFQcH.TMP
%HOMEPATH%\PrintHood\~tQHuSCL1HgjzaVXhVyxE.TMP
%HOMEPATH%\PrintHood\~zublt46LFkodBOb5QJ1K.TMP
%HOMEPATH%\PrintHood\~LwO9SpyqHqmJYkQVHXFu.TMP
%HOMEPATH%\PrintHood\~coyaoqJi0oYCxPqbyjH3.TMP
%HOMEPATH%\PrintHood\~1cTlVl284QLo6LdxUKIa.TMP
%HOMEPATH%\PrintHood\~96CVCsrPRbzbTVGMSNuH.TMP
%HOMEPATH%\PrintHood\~VNmnUlxXmXLqOOx7iKfl.TMP
%HOMEPATH%\PrintHood\~a1xlCjJppyh8L6hCDhOI.TMP
%HOMEPATH%\PrintHood\~ZotORNY6W1jiskEXcgXB.TMP
%HOMEPATH%\PrintHood\~nFHpeM2iiof7jJ3atIyX.TMP
%HOMEPATH%\PrintHood\~jA7geL2taWSwFpezaY9O.TMP

Deletes the following files:

%HOMEPATH%\PrintHood\pangtip.bat
%HOMEPATH%\PrintHood\<Virus name>.exe.txt

Network activity:

Connects to:

'localhost':1036

UDP:

DNS ASK www.ma##kil.in
'<Private IP address>':1035

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: '' WindowName: 'http://www.majakil.in/ - u!u!u!u! - Windows Internet Explorer'
ClassName: '' WindowName: 'u!u!u!u! - Windows Internet Explorer'
ClassName: '' WindowName: 'http://www.majakil.in/ - u!u!u!u! - Microsoft Internet Explorer'
ClassName: '' WindowName: 'u!u!u!u! - Microsoft Internet Explorer'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial